CVE-2014-10065
Content Injection in remarkable
EPSS 0.97%
描述
Versions 1.4.0 and earlier of `remarkable` are affected by a cross-site scripting vulnerability. This occurs because vulnerable versions of `remarkable` did not properly whitelist link protocols, and consequently allowed `javascript:` to be used. ### Proof of Concept Markdown Source: ``` [link](<javascript:alert(1)>) ``` Rendered HTML: ``` <a href="javascript:alert(1)">link</a> ``` ## Recommendation Update to version 1.4.1 or later
如何修補 CVE-2014-10065
要修補 CVE-2014-10065,請將受影響套件升級到下列已修補版本。
- npm/remarkable—升級至 1.4.1 或更新版本
CVE-2014-10065 正在被利用嗎?
低 — EPSS 為 1.0%,目前沒有觀察到大規模利用活動。
受影響套件(1)
- from 0, < 1.4.1