Cross-Site Scripting Vulnerability in ngx-md
Summary
GHSA-xr53-m937-jr9c: Cross-Site Scripting in ngx-md. Affects ngx-md versions < 6.0.3. Fixed in 6.0.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ngx-md is an npm package that provides a Markdown parser and renderer for Angular applications. It allows users to render Markdown content as HTML, providing a convenient way to display formatted text. However, versions prior to 6.0.3 are vulnerable to a Cross-Site Scripting (XSS) attack.
Vulnerability Detail
The vulnerability in ngx-md arises from improper restriction of links to http/https. This allows the inclusion of JavaScript code within links, which can lead to arbitrary code execution. An attacker can craft a malicious Markdown input that includes JavaScript code, such as [Click Me](javascript:alert('Injected!')), which will be rendered as a clickable link. When clicked, the JavaScript code will execute, potentially leading to unauthorized actions or data theft.
How To Fix
Minimum fixed version
6.0.3
This is the first release that contains the fix.
npm install ngx-md@6.0.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to the fixed version to address the issue.
Conclusion
The Cross-Site Scripting vulnerability in ngx-md can lead to arbitrary code execution and potential security breaches in applications using vulnerable versions. It is crucial to upgrade to version 6.0.3 or later to mitigate this vulnerability. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for ngx-md →
FAQ
ngx-md is an npm package that provides a Markdown parser and renderer for Angular applications. It allows developers to easily render Markdown content as HTML.
Cross-Site Scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. This can lead to unauthorized actions or data theft.
If your application uses ngx-md and is using a version prior to 6.0.3, it is vulnerable to Cross-Site Scripting (XSS) attacks. An attacker can craft malicious Markdown input that includes JavaScript code, which can be executed when users interact with the rendered content.
No, there is no known workaround for this vulnerability. It is crucial to upgrade to version 6.0.3 or later of ngx-md to address the issue.
To upgrade ngx-md to the fixed version (6.0.3 or later), you can update the package in your project's package.json file and run the package manager's update command. For example, if you are using npm, you can run npm install ngx-md@6.0.3 to install the fixed version.
