Executive brief
react-marked-markdown is a React component library for rendering Markdown text into HTML. The library fails to properly sanitize href attributes in links, allowing attackers to inject arbitrary JavaScript code that executes in users' browsers when they interact with malicious Markdown content. This vulnerability affects any application that accepts user-provided Markdown input.
Technical details
The vulnerability is a cross-site scripting (CWE-79) flaw in how react-marked-markdown handles href attributes in link elements. When user-supplied Markdown containing JavaScript URIs (e.g., "javascript:alert()") is processed by the MarkdownPreview component, the href value is not properly sanitized even when the sanitize option is enabled. An attacker can craft Markdown input like "[XSS](javascript:alert`1`)" to execute arbitrary JavaScript in the context of the application. The vulnerability affects all versions of the library from 0.0.0 onwards, and no patch has been released as of the advisory date.
Affected products
- Vincent-P react-marked-markdown 0.0.0 and later
Timeline
- 2020-09-01: disclosed