Description
simple-markdown.js in Khan Academy simple-markdown before 0.4.4 allows XSS via a data: or vbscript: URI.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | simple-markdown | < 0.4.4 | 0.4.4 | GHSA-qj3f-9gmq-fwv5 |
References
- https://github.com/Khan/simple-markdown/pull/63
- https://www.npmjs.com/package/simple-markdown/v/0.4.4
- FEDORA-2019-bce274cbf6 vendor-advisory
- FEDORA-2019-8e7c71f45b vendor-advisory
- FEDORA-2019-36ce1cb623 vendor-advisory