Executive brief
mrk.js is a lightweight JavaScript markdown parser library used to convert markdown text into HTML. Versions before 2.0.1 fail to properly sanitize URLs in markdown links and images, allowing attackers to inject malicious JavaScript that executes when HTML is rendered. This is particularly dangerous in web applications that accept user-submitted markdown, such as chat systems or forums.
Technical details
The vulnerability is a cross-site scripting (XSS) flaw (CWE-79) in the markdown-to-HTML conversion process, specifically in the handling of src and href attributes. The parser does not properly sanitize URLs in markdown links and image syntax, allowing attackers to craft markdown containing JavaScript URIs (e.g., `javascript:alert()`) that execute in the browser. The attack requires no authentication and is triggered whenever untrusted markdown is processed and rendered. The fix, released in version 2.0.1, introduced the `mrk.sanitizeURL()` method which developers must explicitly apply to all URL attributes when extending the markdown parser.
Affected products
- mrk.js mrk.js before 2.0.1
Timeline
- 2020-09-01: disclosed: Vulnerability published in GHSA database
- 2018-03-03: patched: Fix merged in PR #3, released as version 2.0.1