Skip to main content

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2026-44721

Low
0/10

Summary

The vulnerability described in this advisory is structurally distinct: a markdown-link payload with a javascript: URI passes through sanitizeResponseContent unchanged (no angle brackets), is then parsed by marked.parse() into an <a href="javascript:..."> element, and rendered live by {@html}. This is a pipeline-ordering flaw where the dangerous construct is introduced after sanitization completes. Removing the video exemption has no effect on this primitive. The affected versions are prior to 0.9.0.

  • LOW
  • NETWORK
  • HIGH
  • UNCHANGED
  • REQUIRED
  • LOW
  • HIGH
  • NONE

CWE-79 - Cross Site Scripting

Cross-Site Scripting, commonly referred to as XSS, is the most dominant class of vulnerabilities. It allows an attacker to inject malicious code into a pregnable web application and victimize its users. The exploitation of such a weakness can cause severe issues such as account takeover, and sensitive data exfiltration. Because of the prevalence of XSS vulnerabilities and their high rate of exploitation, it has remained in the OWASP top 10 vulnerabilities for years.

References

Advisory Timeline

  • Published