Executive brief
marky-markdown is a Node.js markdown parser used to convert user-provided markdown into HTML. The package fails to sanitize HTML attributes in image tags, allowing attackers to inject malicious style attributes that could modify page layout, exfiltrate data, or execute unintended scripts. The package is no longer maintained and affected versions cannot be patched.
Technical details
marky-markdown is vulnerable to HTML injection (CWE-79) through inadequate sanitization of style attributes in image (`img`) tags within markdown input. The vulnerability allows an attacker to craft markdown containing malicious HTML attributes (e.g., `![alt](url" style="...")`). When processed by the library, these unsanitized style attributes are rendered directly into the output HTML. No authentication or user interaction is required; an attacker can inject payload via any markdown input processed by the application. The impact ranges from visual manipulation (resizing images off-page) to CSS-based information disclosure or XSS via advanced browser quirks. The package is unmaintained; migration to `@npmcorp/marky-markdown` is recommended as no fix is available for the original package.
Affected products
- npm marky-markdown all versions
Timeline
- 2020-02-16: disclosed
- 2020-09-03: advisory