Executive brief
simple-markdown is a lightweight JavaScript library for rendering markdown text to HTML. Versions prior to 0.4.4 fail to properly sanitize markdown links containing data: or vbscript: URIs, allowing attackers to inject malicious JavaScript that executes when the rendered HTML is viewed. This can lead to session hijacking, credential theft, or defacement depending on the context in which the markdown is rendered and displayed.
Technical details
The vulnerability is a Cross-Site Scripting (CWE-79) flaw in simple-markdown's link parsing and output generation. When processing markdown link syntax (e.g., `[text](url)`), the library fails to validate or block dangerous URI schemes such as data: and vbscript:. An attacker can craft markdown containing a link with a data: URI containing base64-encoded HTML and JavaScript (e.g., `[link](data:text/html;base64,PHNjcmlwdD5...)`), which is rendered as valid HTML. The vulnerability requires user interaction (opening/rendering the markdown) and network delivery of the malicious markdown, but no authentication. The patch, released in version 0.4.4, adds validation to reject data: and vbscript: URI schemes in link targets.
Affected products
- Khan Academy simple-markdown prior to 0.4.4
Timeline
- 2019-04-09: disclosed: Advisory published
- 2019-03-14: patched: Fix merged (version 0.4.4 released)