CVE-2021-39199— Github remark-html 跨站脚本漏洞

Cross site scripting via unsafe defaults in remark-html

remark-html is an open source nodejs library which compiles Markdown to HTML. In affected versions the documentation of remark-html has mentioned that it was safe by default. In practice the default was never safe and had to be opted into. That is, user input was not sanitized. This means arbitrary HTML can be passed through leading to potential XSS attacks. The problem has been patched in 13.0.2 and 14.0.1: `remark-html` is now safe by default, and the implementation matches the documentation. On older affected versions, pass `sanitize: true` if you cannot update.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

在Web页面生成时对输入的转义处理不恰当(跨站脚本)

Github remark-html 跨站脚本漏洞

Github remark-html是将 Markdown 序列化为 HTML 的remark插件。 remark-html 存在跨站脚本漏洞，该漏洞源于软件对于用户输入没有经过有效的验证与转义。这意味着传递任意的HTML可能会导致潜在的XSS攻击。

N/A

N/A