Executive brief
discord-markdown is a library that converts Discord-style markdown into HTML for display on web pages. When code blocks lack a language identifier, the library fails to properly escape HTML characters, allowing attackers to inject arbitrary HTML and JavaScript into pages that display user-generated markdown, potentially leading to data theft or malicious actions.
Technical details
The vulnerability is an HTML injection / cross-site scripting (XSS) flaw in the discord-markdown library's handling of code blocks. When a code block is provided without a language identifier (triple-backtick syntax), the library fails to escape HTML special characters (<, >, &) before rendering, allowing attacker-controlled HTML tags and scripts to be injected directly into the page. Any website using discord-markdown to parse user-provided markdown content is vulnerable. The fix was patched in version 2.3.1; the vulnerability affects all versions prior to 2.3.0. No authentication or user interaction is required beyond providing markdown content to the affected parser.
Affected products
- discord-markdown discord-markdown before 2.3.1
Timeline
- 2020-02-24: disclosed
- 2020-02-24: patched: Fixed in version 2.3.1