Description
An issue was discovered in the comrak crate before 0.9.1 for Rust. XSS can occur because the protection mechanism for data: and javascript: URIs is case-sensitive, allowing (for example) Data: to be used in an attack.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| crates.io | comrak | < 0.9.1 | 0.9.1 | GHSA-xmr7-v725-2jjr |
| crates.io | comrak | >= 0.0.0-0, < 0.9.1 | 0.9.1 | RUSTSEC-2021-0026 |