PT-2020-21595
Published
2020-09-03
·
Updated
2020-09-03
Description by
Score
N/A
Not availableNo severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
Name of the Vulnerable Software and Affected Versions
ngx-md versions prior to 6.0.3
Description
The issue allows for Cross-Site Scripting due to improper restriction of links to http/https, which can contain JavaScript and lead to arbitrary code execution. For example, Markdown input such as
[Click Me](javascript:alert('Injected!'%29) is rendered as a link that executes JavaScript when clicked.Recommendations
Upgrade to version 6.0.3 or later.
Found an issue in the description? Have something to add? Feel free to write us 👾