buttle cross-site scripting in markdown rendering

Executive brief

buttle is a Node.js library for processing markdown content. A cross-site scripting (XSS) vulnerability in the library's rendering engine allows attackers to inject arbitrary JavaScript code when processing malicious markdown files. Applications using buttle to render user-supplied markdown could expose their users to script injection attacks.

Technical details

buttle is vulnerable to cross-site scripting (CWE-79) due to misconfiguration of its HTML rendering engine, which fails to properly sanitize HTML output generated from markdown input. The vulnerability affects all versions of the library and allows an attacker to inject arbitrary JavaScript when a victim processes a malicious markdown file. This could be exploited in any web application that uses buttle to render markdown content, requiring no authentication. As of the advisory date, no fix was available; the maintainers recommended users switch to alternative markdown processing libraries.

Affected products

• <UNKNOWN> buttle all versions

Timeline

• 2020-09-02: disclosed

References

• https://hackerone.com/reports/404126
• https://www.npmjs.com/advisories/810