Executive brief
markdown-to-jsx is a popular JavaScript library that converts markdown text into React components and HTML. Versions before 6.11.4 fail to properly sanitize links in markdown, allowing attackers to embed malicious JavaScript via data: and vbscript: URIs with base64-encoded payloads. An attacker could inject XSS code that executes in the browser when a user views rendered markdown, potentially stealing session cookies, credentials, or performing unauthorized actions on their behalf.
Technical details
The vulnerability is a cross-site scripting (XSS) flaw caused by insufficient input sanitization in the URL handling logic. The library's sanitizeUrl function failed to properly filter dangerous protocol schemes (javascript:, data:, and vbscript:), which can be obfuscated with whitespace and other special characters to bypass naive filters. An unauthenticated attacker can inject malicious markdown containing these protocol schemes in link elements, and when the markdown is parsed and rendered by markdown-to-jsx, the payload executes in the context of the application. The fix (introduced in version 6.11.4 via PR #307) re-added proper URL sanitization and specifically handles vbscript/data protocol evasion. No patch status is provided for versions after 6.11.4.
Affected products
- probablyup markdown-to-jsx before 6.11.4
Timeline
- 2020-09-03: disclosed
- 2020-05-22: patched: Fix merged in PR #307; patch release 6.11.4