Executive brief
marky-markdown is a markdown parser library that converts markdown to HTML. The library contains a validation flaw that allows attackers to inject arbitrary HTML through iframe elements by bypassing security checks meant to restrict embedded content to trusted sources. This could lead to malicious script execution in the context of applications using this library.
Technical details
This is an HTML injection vulnerability (CWE-79) caused by insufficient validation of iframe sources. The library attempts to whitelist YouTube embeds by checking if the source contains "youtube.com", but the check is bypassable by using URLs where youtube.com appears as a subdomain (e.g., "youtube.com.evil.co"). An attacker can craft a malicious markdown document that, when parsed by marky-markdown and displayed in a web application, executes arbitrary JavaScript in the victim's browser. The vulnerability affects all versions of marky-markdown. The package is no longer maintained; users are advised to migrate to @npmcorp/marky-markdown.
Affected products
- npm marky-markdown all versions
Timeline
- 2020-09-03: disclosed