GHSA-wg85-p6j7-gp3w

SimpleMDE XSS Vulnerability

Source: GitHub Advisory Database (reviewed) Moderate CVE-2018-19057

Packages

Ecosystem	Package	Affected	Fixed in
npm	simplemde	<= 1.11.2	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

SimpleMDE 1.11.2 has XSS via an onerror attribute of a crafted IMG element, or via certain input with `[` and `(` characters, which is mishandled during construction of an `A` element.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2018-19057 advisory
https://github.com/sparksuite/simplemde-markdown-editor/issues/721 web
https://github.com/advisories/GHSA-wg85-p6j7-gp3w advisory
https://github.com/sparksuite/simplemde-markdown-editor package