Skip to content
OpenAdvisories

Package · npm

marky-markdown

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • Medium —
    GHSA-pxmp-fwjc-4x7q

    HTML Injection in marky-markdown

    All versions of `marky-markdown` are vulnerable to HTML Injection due to a validation bypass. The package only allows iframes where the source is `youtube.com` but it is possible to bypass the validation with sources where `youtube.com` is the sub-domain, suc…

    marky-markdown npm
  • High 7.3
    GHSA-mg69-6j3m-jvgw

    HTML Injection in marky-markdown

    All versions of `marky-markdown` are vulnerable to HTML Injection. The package fails to sanitize `style` attributes in `img` tags of the markdown input. This may allow attackers to affect the size of images in the rendered HTML. ## Recommendation This package…

    marky-markdown npm