GHSA-cfjh-p3g4-3q2fMedium

VBScript Content Injection in marked

Published
October 24, 2017
Last Modified
January 9, 2023

🔗 CVE IDs covered (1)

CVE-2015-1370 →

📋 Description

Versions 0.3.2 and earlier of marked are affected by a cross-site scripting vulnerability even when sanitize:true is set.

Proof of Concept ( IE10 Compatibility Mode Only )

[xss link](vbscript:alert(1))

will get a link

<a href="vbscript:alert(1)">xss link</a>

Recommendation

Update to version 0.3.3 or later.

🎯 Affected products1

  • npm/marked:< 0.3.3

🔗 References (9)