Executive brief
markdown-it-highlightjs is a popular JavaScript library that adds syntax highlighting to markdown documents. The inline code highlighting feature in versions before 3.3.1 fails to properly sanitize the language tag, allowing an attacker to inject malicious JavaScript code that executes in a user's browser when the markdown is rendered—potentially stealing session tokens, credentials, or redirecting users to malicious sites.
Technical details
This is a Cross-site Scripting (XSS) vulnerability in the inline code highlighting feature of markdown-it-highlightjs. The vulnerability exists in versions prior to 3.3.1 and is caused by insufficient sanitization of the lang parameter passed to code blocks (e.g., in markdown syntax like `code`{.lang}). An attacker can craft a malicious lang value containing HTML/JavaScript (e.g., `{."><img onerror=alert(1) src=.>js}) that bypasses output escaping and is rendered directly into the HTML output. The attack requires no authentication and is triggered when a user views markdown content containing the payload. Fix: upgrade to version 3.3.1 or later, which escapes invalid lang characters. Patches are available via pull request #14 on the GitHub repository.
Affected products
- markdown-it-highlightjs before 3.3.1
Timeline
- 2020-11-16: disclosed: NVD publication date
- 2020-11-15: patched: Fix merged in pull request #14 on GitHub
- 2022-02-10: advisory: GHSA-f246-xrrj-g8j6 published