mend-for-github-com[bot]
commented
3 years ago :information_source: This issue was automatically closed by WhiteSource because it is a duplicate of an existing issue: #16
Closed mend-for-github-com[bot] closed 3 years ago
mend-for-github-com[bot]
commented
3 years ago :information_source: This issue was automatically closed by WhiteSource because it is a duplicate of an existing issue: #16
CVE-2016-10531 - Medium Severity Vulnerability
A markdown parser built for speed
Library home page: https://cdnjs.cloudflare.com/ajax/libs/marked/0.3.19/marked.js
Path to dependency file: doccano/app/server/static/node_modules/marked/www/demo.html
Path to vulnerable library: doccano/app/server/static/node_modules/marked/www/../lib/marked.js
Dependency Hierarchy: - :x: **marked-0.3.19.js** (Vulnerable Library)
marked is an application that is meant to parse and compile markdown. Due to the way that marked 0.3.5 and earlier parses input, specifically HTML entities, it's possible to bypass marked's content injection protection (`sanitize: true`) to inject a `javascript:` URL. This flaw exists because `&#xNNanything;` gets parsed to what it could and leaves the rest behind, resulting in just `anything;` being left.
Publish Date: 2018-05-31
URL: CVE-2016-10531
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Changed - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: Low - Availability Impact: None
For more information on CVSS3 Scores, click here.Type: Upgrade version
Origin: https://nodesecurity.io/advisories/101
Release Date: 2016-04-18
Fix Resolution: Update to version 0.3.6 or later.