Executive brief
QMarkdown is a markdown rendering library used in web applications to display formatted text. A Cross-Site Scripting (XSS) vulnerability allows attackers to inject malicious scripts into markdown headers even when the no-html security setting is enabled, potentially compromising user sessions or stealing data. This affects applications that render untrusted user-supplied markdown content.
Technical details
QMarkdown (quasar-ui-qmarkdown) before version 2.0.5 contains a Cross-Site Scripting (CWE-79) vulnerability in header processing that bypasses the no-html protection flag. The vulnerability exists because the component fails to properly sanitize HTML/script content in markdown headers even when no-html mode is explicitly set. Attack requires the ability to supply markdown input (no authentication required for public-facing applications), and is network-accessible. An attacker can inject arbitrary JavaScript that executes in the context of the victim's browser. The vulnerability was patched in version 2.0.5 via commit b61dff8, which added proper XSS prevention while maintaining markdown rendering in headers.
Affected products
- Quasar quasar-ui-qmarkdown before 2.0.5
Timeline
- 2025-04-20: disclosed: Vulnerability published as GHSA-wm65-ph3w-587c and CVE-2025-43954
- 2025-02-27: patched: Fixed in version 2.0.5 via commit b61dff84851c45369cf931db5bd93db177c657f6