Description

This affects all versions of package markdown-it-decorate. An attacker can add an event handler or use javascript:xxx for the link.

Remediation

References

https://security.snyk.io/vuln/SNYK-JS-MARKDOWNITDECORATE-1044068

Related Vulnerabilities

CVE-2022-36083 Vulnerability in npm package jose-node-cjs-runtime

CVE-2020-26282 Vulnerability in maven package com.browserup:browserup-proxy-rest

CVE-2022-25948 Vulnerability in npm package liquidjs

CVE-2022-39322 Vulnerability in npm package @keystone-6/core

CVE-2021-26539 Vulnerability in npm package sanitize-html

Severity

High

Classification

CWE-79 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Tags

Exploit Third Party Advisory