CVE-2020-7773

Name of the Vulnerable Software and Affected Versions markdown-it-highlightjs versions prior to 3.3.1

Description This issue allows malicious JavaScript to be inserted as a value of lang in the markdown-it-highlightjs Inline code highlighting feature. The vulnerability can be exploited by manipulating the lang value, enabling the execution of malicious code.

Recommendations For versions prior to 3.3.1, update to version 3.3.1 or later to resolve the issue. As a temporary workaround, consider restricting the use of the lang parameter in the markdown-it-highlightjs Inline code highlighting feature to minimize the risk of exploitation.