Homepage
About Snyk

marky-markdown@8.1.0 vulnerabilities

npm's markdown parser

Go back to all versions of this package
Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the marky-markdown package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • M
Access Restriction Bypass

marky-markdown is a markdown parser, written in NodeJS, that aims for parity with GitHub-style markdown.

Note: This package has been deprecated. It is recommended to use @npmcorp/marky-markdown instead.

Affected versions of this package are vulnerable to Access Restriction Bypass. It only allows iframes where the source is the domain but it is possible to bypass the validation with sub-domain sources.

How to fix Access Restriction Bypass?

There is no fixed version for marky-markdown.

*
  • H
HTML Injection

marky-markdown is a markdown parser, written in NodeJS, that aims for parity with GitHub-style markdown.

Note: This package has been deprecated. It is recommended to use @npmcorp/marky-markdown instead.

Affected versions of this package are vulnerable to HTML Injection. It fails to sanitize style attributes in img tags of the markdown input. This may allow attackers to affect the size of images in the rendered HTML.

How to fix HTML Injection?

There is no fixed version for marky-markdown.

*
Go back to all versions of this package