{"id":"CVE-2020-7773","aliases":["GHSA-f246-xrrj-g8j6","SNYK-JS-MARKDOWNITHIGHLIGHTJS-1040461"],"url":"https://o3.security/vulnerability/CVE-2020-7773","summary":"Cross-site Scripting in markdown-it-highlightjs","details":"This affects the package markdown-it-highlightjs before 3.3.1. It is possible insert malicious JavaScript as a value of lang in the markdown-it-highlightjs Inline code highlighting feature. const markdownItHighlightjs = require(\"markdown-it-highlightjs\"); const md = require('markdown-it'); const reuslt_xss = md() .use(markdownItHighlightjs, { inline: true }) .render('console.log(42){.\">js}'); console.log(reuslt_xss);","published":"2020-11-16T12:15:14.463Z","modified":"2026-07-09T12:32:46.400793Z","cvss":{"score":6.1,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":1,"affectedPackages":[{"ecosystem":"npm","name":"markdown-it-highlightjs","fixedVersion":"3.3.1"}],"fix":{"url":"https://github.com/valeriangalliat/markdown-it-highlightjs/pull/14","label":"valeriangalliat/markdown-it-highlightjs#14"},"references":[{"type":"WEB","url":"https://github.com/valeriangalliat/markdown-it-highlightjs/blob/v3.3.0/index.js%23L52"},{"type":"ADVISORY","url":"https://snyk.io/vuln/SNYK-JS-MARKDOWNITHIGHLIGHTJS-1040461"},{"type":"EVIDENCE","url":"https://github.com/valeriangalliat/markdown-it-highlightjs/pull/14"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-07-09T12:32:46.400793Z"}}