CVE-2018-1000162

· N/AModified

← All CVEs

CVSS v3.1

N/A

EPSS

1.20%

Published

Apr 18, 2018

Modified

Nov 21, 2024

Public PoC / Exploit

All weaponized →

No public PoC or exploit code indexed for this CVE.

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

Parsedown version prior to 1.7.0 contains a Cross Site Scripting (XSS) vulnerability in `setMarkupEscaped` for escaping HTML that can result in JavaScript code execution. This attack appears to be exploitable via specially crafted markdown that allows it to side step HTML escaping by breaking AST boundaries. This vulnerability appears to have been fixed in 1.7.0 and later.

Weaknesses (CWE)

CWE-79

Affected Products (1)

parsedown · parsedown (up to 1.7.0)vulnerable

References (4)

https://github.com/Roave/SecurityAdvisories/issues/44#issuecomment-368594409

Third Party Advisory

https://github.com/erusev/parsedown/pull/495

Third Party Advisory

https://github.com/Roave/SecurityAdvisories/issues/44#issuecomment-368594409

Third Party Advisory

https://github.com/erusev/parsedown/pull/495

Third Party Advisory

KEV Catalog EPSS Scores Vendors All CVEs