CVE-2017-16006
EPSS 0.24%XSS in Data URI in remarkable
發布日:2018/11/9修改日:2023/11/8
描述
Affected versions of `remarkable` are vulnerable to cross-site scripting. Vulnerable versions of the package allow the use of `data:` URIs in links, and can therefore execute javascript. ## Proof of Concept ```markdown [link](data:text/html,<script>alert('0')</script>) ``` ## Recommendation Update to v1.7.0 or later
受影響套件(1)
- npm/remarkablefrom 0, < 1.7.0