GHSA-qgpv-86r3-87fh

Cross-site Scripting in Parsedown

Source: GitHub Advisory Database (reviewed) Moderate CVE-2018-1000162

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	erusev/parsedown	< 1.7.0	1.7.0

Details

As written in the advisory (Markdown source, shown as plain text).

Parsedown version prior to 1.7.0 contains a Cross Site Scripting (XSS) vulnerability in `setMarkupEscaped` for escaping HTML that can result in JavaScript code execution. This attack appears to be exploitable via specially crafted markdown that allows it to side step HTML escaping by breaking AST boundaries. This vulnerability appears to have been fixed in 1.7.0 and later.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2018-1000162 advisory
https://github.com/Roave/SecurityAdvisories/issues/44#issuecomment-368594409 web
https://github.com/erusev/parsedown/pull/495 web
https://github.com/FriendsOfPHP/security-advisories/blob/master/erusev/parsedown/CVE-2018-1000162.yaml web
https://github.com/erusev/parsedown package