Robert Dober

**Name of the Vulnerable Software and Affected Versions** pragdave earmark versions 1.4.1 and later **Description** Improper neutralization of script in attributes in a web page allows stored cross-site scripting via unescaped HTML attribute values. The function ` make att1/2` in `lib/earmark/transform.ex` splices attribute values verbatim between double quotes. While text nodes are processed by an escape function that encodes double quotes as `"`, attribute values bypass this path. Consequently, a markdown link containing a double quote in the URL or title can close the attribute prematurely, allowing the browser to parse subsequent bytes as new HTML attributes and execute arbitrary JavaScript. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.