Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.1

Shiba Markdown Live Preview App 1.1.0 Allows Malicious Code to Run

CVE-2017-1000491 · published 8 years ago
Summary

The Shiba Markdown Live Preview App is not secure, allowing attackers to inject and run malicious code. This means that if you use this app, you may inadvertently let hackers take control of your system. Update to a newer version that fixes this issue to keep your data safe.

What to do
  • Update rhysd shiba to version 1.1.1.
Affected software
Ecosystem VendorProductAffected versions
npm rhysd shiba < 1.1.1
Fix: upgrade to 1.1.1
– shiba_project shiba 1.1.0
cpe:2.3:a:shiba_project:shiba:1.1.0:*:*:*:*:*:*:*
Original advisory text
Shiba markdown live preview app version 1.1.0 is vulnerable to XSS which leads to code execution due to enabled node integration.
Shiba markdown live preview app version 1.1.0 is vulnerable to XSS which leads to code execution due to enabled node integration.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
6.1 Medium
Exploitation
1% chance of attack within 30 days
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published3 Jan 2018
Updated31 Oct 2026
First seen6 Mar 2026
Sources
GHSA-jr64-pggr-j8xj · GHSA
CVE-2017-1000491 · NVD
Track software like this
Free during beta