Executive brief
ngx-md is an Angular directive that renders markdown content in web applications. Versions prior to 6.0.3 fail to properly validate hyperlink URLs, allowing attackers to inject JavaScript code via specially crafted markdown links (e.g., `[Click Me](javascript:alert('Injected!'))`). When a user clicks such a link, arbitrary JavaScript executes in their browser, potentially compromising session data, stealing credentials, or defacing the page.
Technical details
This is a Cross-Site Scripting (CWE-79) vulnerability in ngx-md's markdown link rendering. The library does not restrict link href attributes to safe protocols (http/https), allowing JavaScript protocol URLs to be injected via markdown syntax. An attacker can craft markdown input containing malicious links that execute arbitrary JavaScript when rendered and clicked by a user. No authentication is required—any user able to control markdown input to the application can exploit this. The vulnerability affects all versions before 6.0.3, which is the patched version that implements proper URL validation.
Affected products
- dimpu ngx-md <6.0.3
Timeline
- 2020-09-03: disclosed: Vulnerability advisory published
- 2020-09-03: patched: Fix available in version 6.0.3