GHSA-xmr7-v725-2jjr

Cross site scripting in comrak

Source: GitHub Advisory Database (reviewed) Moderate CVE-2021-27671

Packages

Ecosystem	Package	Affected	Fixed in
crates.io	comrak	< 0.9.1	0.9.1

Details

As written in the advisory (Markdown source, shown as plain text).

An issue was discovered in the comrak crate before 0.9.1 for Rust. Cross site scripting (XSS) can occur because the protection mechanism for data: and javascript: URIs is case-sensitive, allowing (for example) Data: to be used in an attack.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2021-27671 advisory
https://github.com/kivikakk/comrak/commit/b3efbb6e427bcd33bb14db45753ad4fd98e0f5bf web
https://github.com/kivikakk/comrak package
https://github.com/kivikakk/comrak/releases/tag/0.9.1 web
https://rustsec.org/advisories/RUSTSEC-2021-0026.html web