{
"id": "GHSA-qj3f-9gmq-fwv5",
"aliases": [
"CVE-2019-9844"
],
"details": "Versions of `simple-markdown` prior to 0.4.4 are vulnerable to Cross-Site Scripting. Due to insufficient input sanitization the package may render output containing malicious JavaScript. This vulnerability can be exploited through input of links containing `data` or VBScript URIs and a base64-encoded payload.\n\n\n## Recommendation\n\nUpgrade to version 0.4.4 or later.",
"summary": "Cross-Site Scripting in simple-markdown",
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.4.4"
}
]
}
],
"package": {
"name": "simple-markdown",
"ecosystem": "npm"
}
}
],
"modified": "2021-09-16T20:02:36Z",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
],
"published": "2019-04-09T19:47:29Z",
"references": [
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9844",
"type": "ADVISORY"
},
{
"url": "https://github.com/Khan/simple-markdown/pull/63",
"type": "WEB"
},
{
"url": "https://github.com/Khan/simple-markdown",
"type": "PACKAGE"
},
{
"url": "https://github.com/advisories/GHSA-qj3f-9gmq-fwv5",
"type": "ADVISORY"
},
{
"url": "https://lists.fedoraproject.org/archives/list/[email protected] /message/JFLP3KJVSV5VWMNEBRXLGRVYFXOV5KOG",
"type": "WEB"
},
{
"url": "https://lists.fedoraproject.org/archives/list/[email protected] /message/KZG2I7VH7WLSEUQ77KYP5CRAVFT2RK2U",
"type": "WEB"
},
{
"url": "https://lists.fedoraproject.org/archives/list/[email protected] /message/O5EFW655O3BXZYAPB65XEREXB2DSNSOT",
"type": "WEB"
},
{
"url": "https://www.npmjs.com/advisories/815",
"type": "WEB"
},
{
"url": "https://www.npmjs.com/package/simple-markdown/v/0.4.4",
"type": "WEB"
}
],
"schema_version": "1.4.0",
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": true,
"nvd_published_at": null,
"github_reviewed_at": "2020-06-16T21:52:07Z"
}
}