Homepage
About Snyk

moemark@0.3.6 vulnerabilities

Moeditor's markdown parser, forked from marked.

Go back to all versions of this package
Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the moemark package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • H
Cross-site Scripting (XSS)

moemark is a Moeditor's markdown parser, forked from marked.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS). Malicious JavaScript can be inserted as part of a .md file. This can be leveraged to execute arbitrary commands on a victim's system due to nodeIntegration being enabled on moeditor. This issue exists due to no sanitization in momark.

PoC

<onmouseover="alert(1)"> <s onmouseover="var os = require('os'); var hostname = os.platform(); var homedir = os.homedir(); alert('Host:' + hostname + 'directory: ' + homedir);">Hallo</s>

How to fix Cross-site Scripting (XSS)?

There is no fixed version for moemark.

*
Go back to all versions of this package