Homepage

marky-markdown@4.1.3 vulnerabilities

npm's markdown parser

  • latest version

    12.0.0

  • first published

    10 years ago

  • latest version published

    6 years ago

  • deprecated

    Package is deprecated

  • licenses detected

  • View marky-markdown package health on Snyk Advisor  (opens in a new tab)
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the marky-markdown package. This does not include vulnerabilities belonging to this package’s dependencies.

    How to fix?

    Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.

    Fix for free
    VulnerabilityVulnerable Version
    • M
    Access Restriction Bypass

    marky-markdown is a markdown parser, written in NodeJS, that aims for parity with GitHub-style markdown.

    Note: This package has been deprecated. It is recommended to use @npmcorp/marky-markdown instead.

    Affected versions of this package are vulnerable to Access Restriction Bypass. It only allows iframes where the source is the domain but it is possible to bypass the validation with sub-domain sources.

    How to fix Access Restriction Bypass?

    There is no fixed version for marky-markdown.

    *
    • H
    HTML Injection

    marky-markdown is a markdown parser, written in NodeJS, that aims for parity with GitHub-style markdown.

    Note: This package has been deprecated. It is recommended to use @npmcorp/marky-markdown instead.

    Affected versions of this package are vulnerable to HTML Injection. It fails to sanitize style attributes in img tags of the markdown input. This may allow attackers to affect the size of images in the rendered HTML.

    How to fix HTML Injection?

    There is no fixed version for marky-markdown.

    *
    Go back to all versions of this package