What is GHSA-9r27-994c-4xch?

GHSA-9r27-994c-4xch is a security advisory published by GitHub Security Advisories with High severity. discord-html not escaping HTML code blocks when lacking a language identifier

Why does GHSA-9r27-994c-4xch have no CVE ID yet?

GitHub Security Advisories published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

Which products are affected by GHSA-9r27-994c-4xch?

GHSA-9r27-994c-4xch affects 1 product, including: npm/discord-markdown:\u003c 2.3.1.

GHSA-9r27-994c-4xchHighDisclosed before NVD

discord-html not escaping HTML code blocks when lacking a language identifier

Vendor

GitHub Security Advisories

Published

February 24, 2020

Last Modified

January 9, 2023

📋 Description

Impact

Any website using discord-markdown with user-generated markdown is vulnerable to having code injected into the page where the markdown is displayed.

Patches

This has been patched in version 2.3.1

Workarounds

Escape the characters <>& before sending plain code blocks to discord-markdown.

References

https://github.com/brussell98/discord-markdown/issues/13

🎯 Affected products1

npm/discord-markdown:< 2.3.1

🔗 References (4)

https://github.com/brussell98/discord-markdown/security/advisories/GHSA-9r27-994c-4xch
https://github.com/brussell98/discord-markdown/issues/13
https://github.com/brussell98/discord-markdown/commit/7ce2eb66520815dcf5e97ef2bc8a2d5979da66e7
https://github.com/advisories/GHSA-9r27-994c-4xch