HTML Injection in marky-markdownGHSA-mg69-6j3m-jvgw
HIGHGHSA-mg69-6j3m-jvgw is a high-severity (CVSS 7.3) vulnerability in marky-markdown. No vendor fix is recorded yet; mitigation options are listed below.
Real-World Exposure
How broadly this vulnerability is actually deployed: weekly install volume shows current usage, a proxy for how much of the ecosystem is exposed.
marky-markdownnpmDescription
All versions of marky-markdown are vulnerable to HTML Injection. The package fails to sanitize style attributes in img tags of the markdown input. This may allow attackers to affect the size of images in the rendered HTML.
Recommendation
This package is no longer maintained. Please upgrade to @npmcorp/marky-markdown
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 📦npm | marky-markdown | ≥ 0.0.0 | No fix |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for marky-markdown, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Remediation status
No patched version of marky-markdown has shipped for GHSA-mg69-6j3m-jvgw yet. Where your build allows, override or pin the dependency away from the vulnerable range, and apply any maintainer-recommended mitigation.
Mitigate without a patch
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
Frequently Asked Questions
Is GHSA-mg69-6j3m-jvgw in your dependencies?
Find it across npm, including transitive dependencies.