Cross-Site Scripting in marked

GHSA-8wp3-cp9v-44fm

Published Feb 25, 2021 · Modified Feb 25, 2021

Description

Versions 0.3.7 and earlier of marked unescape only lowercase while owsers support both lowercase and uppercase x in hexadecimal form of HTML character entity

References

WEB https://github.com/markedjs/marked/issues/925
WEB https://github.com/markedjs/marked/commit/6d1901ff71abb83aa32ca9a5ce47471382ea42a9

Ready to move

Start Securing

Start for Free Get Demo

Free, no credit card | First findings in minutes