Content injection in marked
Moderate severity
GitHub Reviewed
Published
Feb 25, 2021
to the GitHub Advisory Database
•
Updated Jan 9, 2023
Withdrawn
This advisory was withdrawn on Feb 25, 2021
Description
Reviewed
Jun 5, 2019
Published to the GitHub Advisory Database
Feb 25, 2021
Withdrawn
Feb 25, 2021
Last updated
Jan 9, 2023
Versions 0.3.7 and earlier of marked When mangling is disabled via option mangle don't escape target href. This allow attacker to inject arbitrary html-event into resulting a tag.
References