GHSA-2j5v-fc74-j9q2

Cross-Site Scripting in editor.md

Source: GitHub Advisory Database (reviewed) Moderate CVE-2019-9737

Packages

Ecosystem	Package	Affected	Fixed in
npm	editor.md	1.5.0	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

All versions of `editor.md` are vulnerable to Cross-Site Scripting. User input is insufficiently sanitized, allowing attackers to inject malicious code in payloads containing base64-encoded content. ## Recommendation No fix is currently available. Consider using an alternative module until a fix is made available.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2019-9737 advisory
https://github.com/pandao/editor.md/issues/662 web
https://github.com/advisories/GHSA-2j5v-fc74-j9q2 advisory
https://www.npmjs.com/advisories/794 web