Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
react-marked-markdown allows malicious code in links
published 6 years ago
Summary
react-marked-markdown has a security flaw that can allow attackers to inject malicious code into web pages. This can happen if you let users input links with special instructions. For now, it's best to avoid using this software if you can't control the links being used.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| npm | vincentp | react-marked-markdown | >= 0.0.0 |
Original advisory text
Cross-Site Scripting in react-marked-markdown
All versions of `react-marked-markdown` are vulnerable to cross-site scripting (XSS) via `href` attributes. This is exploitable if user is provided to `react-marked-markdown`
Proof of concept:
```
import React from 'react'
import ReactDOM from 'react-dom'
import { MarkdownPreview } from 'react-marked-markdown'
ReactDOM.render(
<MarkdownPreview
markedOptions={{ sanitize: true }}
value={'[XSS](javascript: alert`1`)'}
/>,
document.getElementById('root')
)
```
## Recommendation
No fix is currently available for this vulnerability. It is our recommendation to not install or use this module at this time if you allow user input into href values.
Proof of concept:
```
import React from 'react'
import ReactDOM from 'react-dom'
import { MarkdownPreview } from 'react-marked-markdown'
ReactDOM.render(
<MarkdownPreview
markedOptions={{ sanitize: true }}
value={'[XSS](javascript: alert`1`)'}
/>,
document.getElementById('root')
)
```
## Recommendation
No fix is currently available for this vulnerability. It is our recommendation to not install or use this module at this time if you allow user input into href values.
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published1 Sep 2020
Updated6 Mar 2026
First seen6 Mar 2026
Sources
GHSA-m7qm-r2r5-f77q · GHSA
Track software like this
Free during beta