Cross-site Scripting (XSS)

Summary

This affects the package markdown-it-highlightjs before 3.3.1. It is possible insert malicious JavaScript as a value of lang in the markdown-it-highlightjs Inline code highlighting feature. const markdownItHighlightjs = require("markdown-it-highlightjs"); const md = require('markdown-it'); const reuslt_xss = md() .use(markdownItHighlightjs, { inline: true }) .render('console.log(42){.">js}'); console.log(reuslt_xss);

Timeline

1. Nov 16, 2020, 12:00 PM UTCCVE published
2. Sep 16, 2024, 10:09 PM UTCRecord last updated

Affected versions

• n/a markdown-it-highlightjs

  fixed in 3.3.1

• markdown-it-highlightjsnpm

  fixed in 3.3.1

References 3