~ / search / GHSA-7px7-7xjx-hxm8

GHSA-7px7-7xjx-hxm8

Marked vulnerable to XSS from data URIs

Source: GitHub Advisory Database (reviewed) Moderate CVE-2017-1000427

Packages

EcosystemPackageAffectedFixed in
npm marked < 0.3.7 0.3.7

Details

As written in the advisory (Markdown source, shown as plain text).

marked version 0.3.6 and earlier is vulnerable to an XSS attack in the data: URI parser.

References

External links from the advisory. They lead to third-party sites.