What is GHSA-pqpp-2363-649v?

GHSA-pqpp-2363-649v is a security advisory published by GitHub Security Advisories with Medium severity. Cross-Site Scripting in buttle

Why does GHSA-pqpp-2363-649v have no CVE ID yet?

GitHub Security Advisories published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

Which products are affected by GHSA-pqpp-2363-649v?

GHSA-pqpp-2363-649v affects 1 product, including: npm/buttle:\u003e= 0.

GHSA-pqpp-2363-649vMediumDisclosed before NVD

Cross-Site Scripting in buttle

Vendor

GitHub Security Advisories

Published

September 2, 2020

Last Modified

January 9, 2023

📋 Description

All versions of buttle are vulnerable to Cross-Site Scripting. Due to misconfiguration of its rendering engine, buttle does not sanitize the HTML output allowing attackers to run arbitrary JavaScript when processing malicious markdown files.

Recommendation

No fix is currently available. Consider using an alternative module until a fix is made available.

🎯 Affected products1

npm/buttle:>= 0

🔗 References (3)

https://hackerone.com/reports/404126
https://www.npmjs.com/advisories/810
https://github.com/advisories/GHSA-pqpp-2363-649v