Ishmeals

The Astro web framework has a DOM Clobbering gadget in the client-side router. This issue can lead to cross-site scripting (XSS) in websites that enable Astro's client-side routing and have stored attacker-controlled scriptless HTML elements, such as `iframe` tags with unsanitized `name` attributes, on the destination pages. The vulnerability can result in XSS attacks on websites built with Astro that enable client-side routing with `ViewTransitions` and store user-inserted scriptless HTML tags without properly sanitizing the `name` attributes on the page.

The issue is related to a DOM Clobbering vulnerability that can lead to Cross-site Scripting (XSS) on web pages where attacker-controlled HTML elements, such as `img` tags with unsanitized `name` attributes, are present. This vulnerability can be exploited due to the presence of unsanitized attributes in HTML elements.

The issue is related to a DOM Clobbering vulnerability in Rollup when bundling scripts with properties from `import.meta` (e.g., `import.meta.url`) in `cjs`/`umd`/`iife` format. This vulnerability can lead to cross-site scripting (XSS) in web pages where scriptless attacker-controlled HTML elements (e.g., an `img` tag with an unsanitized `name` attribute) are present. The DOM Clobbering gadget can be exploited by an attacker to load scripts from an attacker-controlled server.

The notebook feature of Hackmd.io permits the rendering of iframe `HTML` tags with an improperly sanitized `name` attribute. This enables attackers to perform cross-site scripting (XSS) attacks via DOM clobbering.

The issue concerns the markdown parser in CoCalc, which allows `<script>` tags to be included and executed when published. There are no known workarounds for this issue.