Skip to content
OpenAdvisories

Package · Go

github.com/k1LoW/mo

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Low —
    GHSA-vccx-p757-pv6h

    mo has a XSS via inline SVG script tags in Markdown rendering

    ### Summary When rendering Markdown files containing inline SVG elements with `<script>` tags, the embedded JavaScript is executed in the browser. This is due to `rehype-raw` passing raw HTML (including SVG) through to the DOM without sanitization. ### PoC ``…

    github.com/k1LoW/mo Go