# CVE-2015-3296: NodeBB cross-site scripting in Markdown processing

Source: https://junglewise.ai/threats/cve-2015-3296-nodebb-cross-site-scripting-in-markdown-processing  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2022-05-17. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2015-3296 · Severity: low · CVSS 3 · Published 2022-05-17

NodeBB is a forum and discussion platform. An attacker could inject malicious JavaScript code into posts via specially-crafted markdown, and any visitor viewing the post would execute that code in their browser. This could allow account takeover, credential theft, or malware distribution to forum users.

Technologies: [NodeBB](https://junglewise.ai/threats/technologies/nodebb). Vendors: [NodeBB](https://junglewise.ai/threats/vendors/nodebb), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2015-3296 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2015-3296 being exploited in the wild.

**How severe is CVE-2015-3296?** Low severity, with a CVSS score of 3, published 17 May 2022.

**Which products and versions are affected?** NodeBB before 0.7; nodebb-plugin-markdown (npm) SEMVER:introduced=0,fixed=5.1.1.

**Is there a fix for CVE-2015-3296?** Yes. nodebb-plugin-markdown (npm): upgrade to 5.1.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2015-3296 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2015-3296?** Check whether you run NodeBB or nodebb-plugin-markdown (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- nodebb-plugin-markdown (npm): upgrade to 5.1.1 or later

  ```sh
  npm install nodebb-plugin-markdown@5.1.1
  ```


## Technical details

Multiple cross-site scripting (XSS) vulnerabilities exist in NodeBB's markdown processing engine, allowing injection of arbitrary HTML and JavaScript through javascript: and data: URL schemes. The vulnerability is present in the markdown-it library used by NodeBB; attackers can inject payloads such as image tags with malicious URLs that execute when the post is rendered. The attack requires no authentication (public posts are viewable by all) and succeeds when a visitor views the crafted post. NodeBB versions before 0.7 and nodebb-plugin-markdown before 5.1.1 are affected. Patches are available in the fixed versions.

## Affected products

- NodeBB NodeBB before 0.7
- NodeBB nodebb-plugin-markdown before 5.1.1

## Identifiers

- CVE-2015-3296
- GHSA-9g4f-5rpg-4948

## Timeline

- 2014-10-16: disclosed
- 2017-09-21: advisory: NVD published CVE-2015-3296
- 2015: patched: NodeBB 0.7 and nodebb-plugin-markdown 5.1.1 fix the issue

## References

- [https://github.com/NodeBB/NodeBB/issues/2273](https://github.com/NodeBB/NodeBB/issues/2273)

## Related threats

- [NodeBB authorization bypass in user registration](https://junglewise.ai/threats/cve-2026-120007-nodebb-1-18-0-through-4-16-5-contains-an-authorization-bypass)
- [NodeBB author spoofing via unvalidated ActivityPub attributedTo field](https://junglewise.ai/threats/cve-2026-58593-nodebb-author-spoofing-via-unvalidated-activitypub-attributedto)
- [NodeBB SQL injection in search-categories endpoint](https://junglewise.ai/threats/cve-2025-50979-nodebb-sql-injection-in-search-categories-endpoint)
- [NodeBB persistent cross-site scripting in profile](https://junglewise.ai/threats/cve-2024-57041-nodebb-persistent-cross-site-scripting-in-profile)
- [NodeBB incorrect access control in admin tabs](https://junglewise.ai/threats/cve-2024-29316-nodebb-incorrect-access-control-in-admin-tabs)