What is GHSA-9g4f-5rpg-4948?

GHSA-9g4f-5rpg-4948 is a security advisory published by GitHub Security Advisories with Medium severity. NodeBB Cross-site Scripting Vulnerability in Markdown Processing

Which CVE IDs does GHSA-9g4f-5rpg-4948 cover?

GHSA-9g4f-5rpg-4948 covers the following CVE IDs: CVE-2015-3296. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-9g4f-5rpg-4948?

GHSA-9g4f-5rpg-4948 has a CVSS v3 base score of 6.1, published by GitHub Security Advisories.

Which products are affected by GHSA-9g4f-5rpg-4948?

GHSA-9g4f-5rpg-4948 affects 2 products, including: npm/nodebb:\u003c 0.70; npm/nodebb-plugin-markdown:\u003c 5.1.1.

GHSA-9g4f-5rpg-4948MediumCVSS 6.1

NodeBB Cross-site Scripting Vulnerability in Markdown Processing

Vendor

GitHub Security Advisories

Published

May 17, 2022

Last Modified

August 13, 2023

🔗 CVE IDs covered (1)

CVE-2015-3296 →

📋 Description

Multiple cross-site scripting (XSS) vulnerabilities in NodeBB before 0.7 allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) javascript: or (2) data: URLs.

🎯 Affected products2

npm/nodebb:< 0.70
npm/nodebb-plugin-markdown:< 5.1.1

🔗 References (7)

https://nvd.nist.gov/vuln/detail/CVE-2015-3296
http://www.openwall.com/lists/oss-security/2015/04/10/10
https://github.com/NodeBB/NodeBB/issues/2273
https://github.com/NodeBB/nodebb-plugin-markdown/commit/ab7f2684750882f7baefbfa31db8d5aac71e6ec3
https://github.com/markdown-it/markdown-it/commit/f76d3beb46abd121892a2e2e5c78376354c214e3
https://web.archive.org/web/20200228230630/http://www.securityfocus.com/bid/71824
https://github.com/advisories/GHSA-9g4f-5rpg-4948