6.1
Moyenne
CVE-2024-21535 Versions of the package markdown-to-jsx before 7.4.0 are vulnerable to Cross-site Scripting (XSS) via the src property…
Description
Versions of the package markdown-to-jsx before 7.4.0 are vulnerable to Cross-site Scripting (XSS) via the src property due to improper input sanitization. An attacker can execute arbitrary code by injecting a malicious iframe element in the markdown.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| markdown-to-jsx 7.4 | premières → < 7.4.0 | 7.4.0 |
| markdown-to-jsx 7.4 | premières → < 7.4.0 | 7.4.0 |