Skip to content
OpenAdvisories

Package · npm

marky-markdown

2 known vulnerabilities.

1 result · Clear filters · Feed

  • Medium —

    HTML Injection in marky-markdown

    All versions of `marky-markdown` are vulnerable to HTML Injection due to a validation bypass. The package only allows iframes where the source is `youtube.com` but it is possible to bypass the validation with sources where `youtube.com` is the sub-domain, suc…