Homepage

moemark@0.3.6 vulnerabilities

Moeditor's markdown parser, forked from marked.

  • latest version

    0.3.10

  • first published

    9 years ago

  • latest version published

    8 years ago

  • licenses detected

  • View moemark package health on Snyk Advisor  (opens in a new tab)
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the moemark package. This does not include vulnerabilities belonging to this package’s dependencies.

    Fix vulnerabilities automatically

    Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

    Fix for free
    VulnerabilityVulnerable Version
    • H
    Cross-site Scripting (XSS)

    moemark is a Moeditor's markdown parser, forked from marked.

    Affected versions of this package are vulnerable to Cross-site Scripting (XSS). Malicious JavaScript can be inserted as part of a .md file. This can be leveraged to execute arbitrary commands on a victim's system due to nodeIntegration being enabled on moeditor. This issue exists due to no sanitization in momark.

    PoC

    <onmouseover="alert(1)"> <s onmouseover="var os = require('os'); var hostname = os.platform(); var homedir = os.homedir(); alert('Host:' + hostname + 'directory: ' + homedir);">Hallo</s>

    How to fix Cross-site Scripting (XSS)?

    There is no fixed version for moemark.

    *
    Go back to all versions of this package