MEDIUM6.1

GHSA-36m4-6v6m-4vpr

Cross-site Scripting in remarkable

Quick fix

GHSA-36m4-6v6m-4vpr — remarkable: upgrade to the fixed version with the command below.

npm install remarkable@1.7.2

Details

In remarkable 1.7.1, lib/parser_inline.js mishandles URL filtering, which allows attackers to trigger XSS via unprintable characters, as demonstrated by a `\x0ejavascript:` URL.

Are you affected?

Enter the version of the package you're using.

Affected packages

npm/remarkable

Introduced in: 0Fixed in: 1.7.2

Fixnpm install remarkable@1.7.2

References

https://nvd.nist.gov/vuln/detail/CVE-2019-12043[ADVISORY]
https://github.com/jonschlinkert/remarkable/issues/332[WEB]
https://github.com/jonschlinkert/remarkable/commit/49e87b7ae2dc323d83606792a749fb207595249e[WEB]