CVE-2017-16006
XSS in Data URI in remarkable
EPSS 0.98%
描述
Affected versions of `remarkable` are vulnerable to cross-site scripting. Vulnerable versions of the package allow the use of `data:` URIs in links, and can therefore execute javascript. ## Proof of Concept ```markdown [link](data:text/html,<script>alert('0')</script>) ``` ## Recommendation Update to v1.7.0 or later
如何修補 CVE-2017-16006
要修補 CVE-2017-16006,請將受影響套件升級到下列已修補版本。
- npm/remarkable—升級至 1.7.0 或更新版本
CVE-2017-16006 正在被利用嗎?
低 — EPSS 為 1.0%,目前沒有觀察到大規模利用活動。
受影響套件(1)
- from 0, < 1.7.0