MEDIUM6.1

GHSA-4wx3-54gh-9fr9

Cross site scripting in markdown-to-jsx

Quick fix

GHSA-4wx3-54gh-9fr9 — markdown-to-jsx: upgrade to the fixed version with the command below.

npm install markdown-to-jsx@7.4.0

Details

Versions of the package markdown-to-jsx before 7.4.0 are vulnerable to Cross-site Scripting (XSS) via the src property due to improper input sanitization. An attacker can execute arbitrary code by injecting a malicious iframe element in the markdown.

Are you affected?

Enter the version of the package you're using.

Affected packages

npm/markdown-to-jsx

Introduced in: 0Fixed in: 7.4.0

Fixnpm install markdown-to-jsx@7.4.0

References

https://nvd.nist.gov/vuln/detail/CVE-2024-21535[ADVISORY]
https://github.com/quantizor/markdown-to-jsx/commit/8eb74da825c0d8d2e9508d73c672bcae36ba555a[WEB]
https://github.com/quantizor/markdown-to-jsx[PACKAGE]
https://security.snyk.io/vuln/SNYK-JS-MARKDOWNTOJSX-6258886[WEB]