Alfinj0Se

**Name of the Vulnerable Software and Affected Versions** justhtml versions prior to 1.13.0 **Description** A cross-site scripting issue exists in the `to markdown()` function during the serialization of attacker-controlled pre content. By placing backticks inside sanitized pre elements, an attacker can break out of fixed-length code fences. This allows raw HTML to execute when the resulting Markdown is processed by CommonMark or GFM-style renderers. **Recommendations** Update justhtml to version 1.13.0 or later.

**Name of the Vulnerable Software and Affected Versions** mongo-express version 1.0.2 **Description** The issue allows for Cross-Site Request Forgery (CSRF) attacks, as demonstrated by the deletion of a Collection through the /admin endpoint. **Recommendations** For mongo-express version 1.0.2, consider restricting access to the /admin endpoint to minimize the risk of exploitation. As a temporary workaround, implement CSRF protection mechanisms until a patch is available.