~ / search / GHSA-6wj2-g87r-pm62

GHSA-6wj2-g87r-pm62

Cross-site Scripting in comrak

Source: GitHub Advisory Database (reviewed) Moderate CVE-2021-38186

Packages

EcosystemPackageAffectedFixed in
crates.io comrak < 0.10.1 0.10.1

Details

As written in the advisory (Markdown source, shown as plain text).

An issue was discovered in the comrak crate before 0.10.1 for Rust. It mishandles & characters, leading to XSS via &# HTML entities.

References

External links from the advisory. They lead to third-party sites.