MEDIUM
GHSA-pqpp-2363-649v
Cross-Site Scripting in buttle
Details
All versions of `buttle` are vulnerable to Cross-Site Scripting. Due to misconfiguration of its rendering engine, `buttle` does not sanitize the HTML output allowing attackers to run arbitrary JavaScript when processing malicious markdown files.
## Recommendation
No fix is currently available. Consider using an alternative module until a fix is made available.
Are you affected?
Enter the version of the package you're using.
Affected packages
npm/buttle
Introduced in:
0No fixed version published yet for buttle (npm). Pin to a known-safe version or switch to an alternative.