GHSA-MG69-6J3M-JVGW高危已审查

HTML Injection in marky-markdown

OSV 1.4.0 · github-reviewed · 修改于 2021-10-05 04:55

发布时间

2020-09-03 23:45

GitHub 审查时间

2020-09-01 03:00

NVD 发布时间

—

源文件

advisories/github-reviewed/2020/09/GHSA-mg69-6j3m-jvgw/GHSA-mg69-6j3m-jvgw.json

公告说明

All versions of marky-markdown are vulnerable to HTML Injection. The package fails to sanitize style attributes in img tags of the markdown input. This may allow attackers to affect the size of images in the rendered HTML.

Recommendation

This package is no longer maintained. Please upgrade to @npmcorp/marky-markdown

受影响的软件包

npm

marky-markdown

ECOSYSTEM

引入0.0.0

标识信息

别名 / CVE

无

CWE

CWE-79

软件生态

npm

扩展资料

暂无扩展资料。

CVSS 评分

CVSS_V3

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

原始 OSV JSON

{
  "id": "GHSA-mg69-6j3m-jvgw",
  "aliases": [],
  "details": "All versions of `marky-markdown` are vulnerable to HTML Injection. The package fails to sanitize `style` attributes in `img` tags of the markdown input. This may allow attackers to affect the size of images in the rendered HTML.\n\n\n## Recommendation\n\nThis package is no longer maintained. Please upgrade to `@npmcorp/marky-markdown`",
  "summary": "HTML Injection in marky-markdown",
  "affected": [
    {
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0.0.0"
            }
          ]
        }
      ],
      "package": {
        "name": "marky-markdown",
        "ecosystem": "npm"
      }
    }
  ],
  "modified": "2021-10-04T20:55:27Z",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
    }
  ],
  "published": "2020-09-03T15:45:08Z",
  "references": [
    {
      "url": "https://github.com/npm/marky-markdown",
      "type": "PACKAGE"
    },
    {
      "url": "https://snyk.io/vuln/SNYK-JS-MARKYMARKDOWN-548871",
      "type": "WEB"
    },
    {
      "url": "https://www.npmjs.com/advisories/1470",
      "type": "WEB"
    }
  ],
  "schema_version": "1.4.0",
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "nvd_published_at": null,
    "github_reviewed_at": "2020-08-31T19:00:28Z"
  }
}