GHSA-hhrp-qm88-xjr3

Valine HTML Injection

Source: GitHub Advisory Database (reviewed) Moderate CVE-2018-19289

Packages

Ecosystem	Package	Affected	Fixed in
npm	valine	< 1.3.4	1.3.4

Details

As written in the advisory (Markdown source, shown as plain text).

An issue was discovered in Valine v1.3.3. It allows HTML injection, which can be exploited for JavaScript execution via an EMBED element in conjunction with a .pdf file.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2018-19289 advisory
https://github.com/xCss/Valine/issues/127 web
https://github.com/xCss/Valine/commit/32d4d5e68df804f0eabb1a2bebbbf9459e31c2b7 web
https://github.com/advisories/GHSA-hhrp-qm88-xjr3 advisory
https://github.com/xCss/Valine package