Executive brief
markdown-it-decorate is a Node.js library that adds HTML attributes, IDs, and classes to Markdown content. The library contains a cross-site scripting (XSS) vulnerability that allows attackers to inject malicious scripts into generated HTML. This could affect any web application or content management system that uses the library to process user-supplied or untrusted Markdown input, potentially compromising user sessions or stealing sensitive data.
Technical details
The vulnerability is a reflected XSS issue (CWE-79) in markdown-it-decorate's attribute parsing logic. All versions through 1.2.2 fail to properly sanitize or escape user input when processing Markdown decorations and attributes, allowing attackers to inject arbitrary HTML and JavaScript. The attack requires user interaction to render the malicious Markdown, typically via application features that preview or display user-supplied content. An attacker can craft a malicious Markdown document that, when processed by the vulnerable library, generates HTML containing unescaped script tags or event handlers. No patched version has been released; the library's maintainers have not addressed this issue despite its public disclosure.
Affected products
- rstacruz markdown-it-decorate all versions up to and including 1.2.2
Timeline
- 2022-07-19: disclosed: GHSA advisory published
- 2022-07-25: other: NVD entry published