Description
Mbin 1.2.1 before 1.11.1 contains a stored cross-site scripting vulnerability in EmbedElement::buildDestructed() that renders nested Markdown image alt text and URL without HTML escaping. Authenticated users can embed HTML in the alt text of an image inside a link in entries, comments, posts, messages, or bios to run script in viewers' browsers.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| MbinOrg | mbin | 1.2.1 – < 1.11.1 | 1.11.1 |
References
- GitHub Security Advisory (GHSA-g3r9-j6w4-2257) vendor-advisory
- https://github.com/MbinOrg/mbin/commit/736fd39fe9cd59f5d51636d25e1857d88ddbd0bd patch
- mbin v1.11.1 Release Notes release-notes
- https://github.com/MbinOrg/mbin/blob/v1.11.0/src/Markdown/CommonMark/EmbedElement.php#L57-L67 technical-description
- VulnCheck Advisory: Mbin 1.2.1 before 1.11.1 Stored XSS via Markdown Image Nested in Link third-party-advisory