{"id":"CVE-2019-12043","aliases":["GHSA-36m4-6v6m-4vpr"],"url":"https://o3.security/vulnerability/CVE-2019-12043","summary":"Cross-site Scripting in remarkable","details":"In remarkable 1.7.1, lib/parser_inline.js mishandles URL filtering, which allows attackers to trigger XSS via unprintable characters, as demonstrated by a \\x0ejavascript: URL.","published":"2019-05-13T14:29:01.987Z","modified":"2026-07-08T15:54:47.571649Z","cvss":{"score":6.1,"severity":"MEDIUM","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"npm","name":"remarkable","fixedVersion":"1.7.2"}],"fix":null,"references":[{"type":"EVIDENCE","url":"https://github.com/jonschlinkert/remarkable/issues/332"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-07-08T15:54:47.571649Z"}}