What is GHSA-9cw2-jqp5-7x39?

GHSA-9cw2-jqp5-7x39 is a security advisory published by GitHub Security Advisories with Medium severity. Multiple Content Injection Vulnerabilities in marked

Which CVE IDs does GHSA-9cw2-jqp5-7x39 cover?

GHSA-9cw2-jqp5-7x39 covers the following CVE IDs: CVE-2014-3743. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-9cw2-jqp5-7x39?

GHSA-9cw2-jqp5-7x39 has a CVSS v3 base score of 6.1, published by GitHub Security Advisories.

Which products are affected by GHSA-9cw2-jqp5-7x39?

GHSA-9cw2-jqp5-7x39 affects 1 product, including: npm/marked:\u003c= 0.3.0.

GHSA-9cw2-jqp5-7x39MediumCVSS 6.1

Multiple Content Injection Vulnerabilities in marked

Vendor

GitHub Security Advisories

Published

August 31, 2020

Last Modified

January 9, 2023

🔗 CVE IDs covered (1)

CVE-2014-3743 →

📋 Description

Versions 0.3.0 and earlier of marked are affected by two cross-site scripting vulnerabilities, even when sanitize: true is set.

The attack vectors for this vulnerability are GFM Codeblocks and JavaScript URLs.

Recommendation

Upgrade to version 0.3.1 or later.

🎯 Affected products1

npm/marked:<= 0.3.0

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2014-1850
https://www.npmjs.com/advisories/22
https://github.com/advisories/GHSA-9cw2-jqp5-7x39