Executive brief
markdown-to-jsx is a widely-used JavaScript library that converts markdown text into React components for display in web applications. The library failed to sanitize the "src" attribute in HTML elements, allowing attackers to inject malicious iframe tags or other elements with arbitrary JavaScript URLs. When a user views markdown content containing such malicious markup, the injected JavaScript runs in their browser, potentially exposing session cookies, stealing data, or performing unauthorized actions on their behalf.
Technical details
The vulnerability is a classic cross-site scripting (XSS) flaw in the markdown-to-jsx library affecting versions before 7.4.0. The root cause is improper input sanitization: while the library sanitized the href attribute for links, it failed to apply the same sanitization to the src attribute used in iframes and image elements. An attacker can inject a malicious iframe element with a javascript: protocol URL (e.g., <iframe src="javascript:alert()"></iframe>) directly into markdown content. When the parser processes this markdown without proper URL validation, the injected code executes in the victim's browser context with full access to the page's DOM and cookies. The attack requires no special privileges and only user interaction to view the affected markdown content. The fix, applied in commit 8eb74da, extends the href attribute sanitization function (sanitizeUrl) to also cover the src attribute, preventing javascript: and other dangerous protocols from being executed.
Affected products
- markdown-to-jsx markdown-to-jsx <7.4.0
Timeline
- 2024-10-15: disclosed: Vulnerability published on OSV and NVD
- 2024-10-15: patched: Fix released in version 7.4.0