Is CVE-2014-10065 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2014-10065 being exploited in the wild.

How severe is CVE-2014-10065?

Informational severity, published 31 August 2020.

Which products and versions are affected?

remarkable (npm) SEMVER:introduced=0,fixed=1.4.1.

Is there a fix for CVE-2014-10065?

Yes. remarkable (npm): upgrade to 1.4.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2014-10065 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2014-10065?

Check whether you run remarkable (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2014-10065: remarkable content injection via unescaped javascript protocol

CVE-2014-10065 · Severity: info · Published 2020-08-31

Remarkable is a popular Markdown parser library used to convert user-written Markdown into HTML for display in web applications. Versions 1.4.0 and earlier fail to properly block the "javascript:" protocol in links, allowing attackers to inject malicious JavaScript code that executes when users click crafted links. This could lead to account compromise, session hijacking, or theft of sensitive data from affected users.

Technologies: remarkable (npm). Vendors: npm.

Quick answers

Is CVE-2014-10065 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2014-10065 being exploited in the wild.
How severe is CVE-2014-10065?: Informational severity, published 31 August 2020.
Which products and versions are affected?: remarkable (npm) SEMVER:introduced=0,fixed=1.4.1.
Is there a fix for CVE-2014-10065?: Yes. remarkable (npm): upgrade to 1.4.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2014-10065 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2014-10065?: Check whether you run remarkable (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

remarkable (npm): upgrade to 1.4.1 or later
```
npm install remarkable@1.4.1
```

Technical details

The vulnerability is a cross-site scripting (XSS) / content injection flaw caused by improper URL protocol whitelisting in the link rendering component. Versions 1.4.0 and earlier do not properly escape or validate the protocol portion of URLs in Markdown links, allowing the dangerous "javascript:" protocol to pass through to the rendered HTML. An attacker can craft a Markdown snippet like `[link](<javascript:alert(1)>)` which renders as an exploitable HTML anchor tag with `href="javascript:alert(1)"`. No authentication or special preconditions are required—any user-supplied Markdown processed by the library is affected. The fix was released in version 1.4.1.

Affected products

jonschlinkert remarkable 1.4.0 and earlier

Identifiers

CVE-2014-10065
GHSA-f9vc-q3hh-qhfv

Timeline

2014-11-06: disclosed: Issue reported on GitHub
2014: patched: Fix released in version 1.4.1
2020-08-31: advisory: GHSA-f9vc-q3hh-qhfv published

References

https://github.com/jonschlinkert/remarkable/issues/97

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.