GHSA-36m4-6v6m-4vprMediumCVSS 6.1

Cross-site Scripting in remarkable

Published
May 29, 2019
Last Modified
September 8, 2023

🔗 CVE IDs covered (1)

CVE-2019-12043 →

📋 Description

In remarkable 1.7.1, lib/parser_inline.js mishandles URL filtering, which allows attackers to trigger XSS via unprintable characters, as demonstrated by a \x0ejavascript: URL.

🎯 Affected products1

  • npm/remarkable:< 1.7.2

🔗 References (4)