# buttle cross-site scripting in markdown rendering

Source: https://junglewise.ai/threats/buttle-cross-site-scripting-in-markdown-rendering-9a0d6176  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2020-09-02. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

Severity: info · Published 2020-09-02

buttle is a Node.js library for processing markdown content. A cross-site scripting (XSS) vulnerability in the library's rendering engine allows attackers to inject arbitrary JavaScript code when processing malicious markdown files. Applications using buttle to render user-supplied markdown could expose their users to script injection attacks.

Technologies: [buttle (npm)](https://junglewise.ai/threats/technologies/buttle). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Informational severity, published 2 September 2020.

**Which products and versions are affected?** buttle (npm) SEMVER:introduced=0.

**Is there a fix for This vulnerability?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is This vulnerability attacked?** It is attacked over the network, in a software library.

**Am I affected?** Check whether you run buttle (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

buttle is vulnerable to cross-site scripting (CWE-79) due to misconfiguration of its HTML rendering engine, which fails to properly sanitize HTML output generated from markdown input. The vulnerability affects all versions of the library and allows an attacker to inject arbitrary JavaScript when a victim processes a malicious markdown file. This could be exploited in any web application that uses buttle to render markdown content, requiring no authentication. As of the advisory date, no fix was available; the maintainers recommended users switch to alternative markdown processing libraries.

## Affected products

- <UNKNOWN> buttle all versions

## Timeline

- 2020-09-02: disclosed

## References

- [https://hackerone.com/reports/404126](https://hackerone.com/reports/404126)
- [https://www.npmjs.com/advisories/810](https://www.npmjs.com/advisories/810)

## Related threats

- [buttle Cross-Site Scripting in filename sanitization](https://junglewise.ai/threats/cve-2019-5422-buttle-cross-site-scripting-in-filename-sanitization)
- [buttle path traversal](https://junglewise.ai/threats/cve-2018-3766-buttle-path-traversal)