Cross-Site Scripting Vulnerability in node-markdown-it Package
Summary
UBUNTU-CVE-2025-7969: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in markdown-it allows Cross-Site Scripting (XSS). Affects node-markdown-it versions 10.0.0+dfsg-2 – 10.0.0+dfsg-6. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The node-markdown-it package is a popular Markdown parser and renderer for Node.js applications. It allows developers to convert Markdown text into HTML, providing a flexible and extensible way to handle Markdown content. This package is widely used in web applications for rendering user-generated content. However, it has been identified to have a vulnerability that could lead to Cross-Site Scripting (XSS) attacks, compromising the security of applications that utilize it.
Vulnerability Detail
The vulnerability identified as CVE-2025-7969 is due to improper neutralization of input during web page generation, specifically in the lib/renderer.mjs file of the markdown-it package. This flaw allows attackers to inject malicious scripts into web pages viewed by users, leading to potential data theft, session hijacking, or other malicious activities. The vulnerability affects versions of markdown-it up to 14.1.0, and while the supplier does not classify it as a vulnerability, it poses a significant risk to applications that do not sanitize user input properly.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If an immediate update is not possible, consider implementing input sanitization in your application to strip out potentially harmful scripts from user inputs before rendering them on the web page. This can be done using libraries such as DOMPurify or similar.
Conclusion
The CVE-2025-7969 vulnerability in the node-markdown-it package poses a significant risk of Cross-Site Scripting attacks. It is crucial for developers using this package to update to the latest patched versions and implement proper input sanitization to protect their applications from potential exploits.
See every vulnerability recorded for node-markdown-it →
FAQ
XSS is a security vulnerability that allows attackers to inject malicious scripts into web pages viewed by users, potentially leading to data theft or session hijacking.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check your application using the Vulert playground without any signup.
The impacts include unauthorized access to user data, session hijacking, and the ability to perform actions on behalf of users without their consent.
Yes, there are patched versions available for the node-markdown-it package. It is important to update to these versions to mitigate the risk.
If an immediate update is not feasible, implement input sanitization to prevent malicious scripts from being executed in your application.
Related vulnerabilities
Recent vulnerabilities recorded for node-markdown-it.
