Description

Incomplete blacklist vulnerability in marked 0.3.2 and earlier for Node.js allows remote attackers to conduct cross-site scripting (XSS) attacks via a vbscript tag in a link.

Remediation

References

https://nodesecurity.io/advisories/marked_vbscript_injection

https://github.com/chjj/marked/issues/492

http://www.openwall.com/lists/oss-security/2015/01/23/2

https://github.com/evilpacket/marked/commit/3c191144939107c45a7fa11ab6cb88be6694a1ba

Related Vulnerabilities

CVE-2019-14772 Vulnerability in npm package verdaccio

CVE-2018-20190 Vulnerability in npm package node-sass

CVE-2021-23376 Vulnerability in npm package ffmpegdotjs

CVE-2019-19935 Vulnerability in npm package froala-editor

CVE-2017-16135 Vulnerability in npm package serverzyy

Severity

Critical

Tags

Exploit NVD-CWE-Other