GHSA-36m4-6v6m-4vpr
Cross-site Scripting in remarkable
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | remarkable | < 1.7.2 | 1.7.2 |
Details
As written in the advisory (Markdown source, shown as plain text).
In remarkable 1.7.1, lib/parser_inline.js mishandles URL filtering, which allows attackers to trigger XSS via unprintable characters, as demonstrated by a `\x0ejavascript:` URL.
References
External links from the advisory. They lead to third-party sites.