{"id":"CVE-2014-10065","aliases":[],"url":"https://o3.security/vulnerability/CVE-2014-10065","summary":"Content Injection in remarkable","details":"Versions 1.4.0 and earlier of `remarkable` are affected by a cross-site scripting vulnerability. This occurs because vulnerable versions of `remarkable` did not properly whitelist link protocols, and consequently allowed `javascript:` to be used. \n\n\n### Proof of Concept\n\nMarkdown Source:\n```\n[link](<javascript:alert(1)>)\n```\n\nRendered HTML:\n```\n<a href=\"javascript:alert(1)\">link</a>\n```\n\n\n## Recommendation\n\nUpdate to version 1.4.1 or later","published":"2020-08-31T22:56:00Z","modified":"2023-11-08T03:57:33.593508Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"npm","name":"remarkable","fixedVersion":"1.4.1"}],"fix":{"url":"https://github.com/jonschlinkert/remarkable/commit/d54ed887f4997221cd7cb9790e953a83c504de36","label":"jonschlinkert/remarkable@d54ed88"},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2014-10065"},{"type":"WEB","url":"https://github.com/jonschlinkert/remarkable/issues/97"},{"type":"WEB","url":"https://github.com/jonschlinkert/remarkable/commit/d54ed887f4997221cd7cb9790e953a83c504de36"},{"type":"WEB","url":"https://www.npmjs.com/advisories/30"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2023-11-08T03:57:33.593508Z"}}