Content injection in marked

GHSA-wjmf-58vc-xqjr

Published Feb 25, 2021 · Modified Feb 25, 2021

Description

Versions 0.3.7 and earlier of marked When mangling is disabled via option mangle don't escape target href. This allow attacker to inject arbitrary html-event into resulting a tag.

References

WEB https://github.com/markedjs/marked/issues/926
WEB https://github.com/markedjs/marked/commit/cb72584c5d9d32ebfdbb99e35fb9b81af2b79686

Ready to move

Start Securing

Start for Free Get Demo

Free, no credit card | First findings in minutes