Medium severity · published Apr 18, 2018
CVE-2018-1000162
Parsedown version prior to 1.7.0 contains a Cross Site Scripting (XSS) vulnerability in `setMarkupEscaped` for escaping HTML that can result in JavaScript code execution
6.1
CVSS
1.2%
EPSS
No
On KEV
Description
Parsedown version prior to 1.7.0 contains a Cross Site Scripting (XSS) vulnerability in `setMarkupEscaped` for escaping HTML that can result in JavaScript code execution. This attack appears to be exploitable via specially crafted markdown that allows it to side step HTML escaping by breaking AST boundaries. This vulnerability appears to have been fixed in 1.7.0 and later.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 67% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PA
Parsedown · Parsedown
before 1.7.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-1000162
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-1000162
Third Party Advisory
https://github.com/Roave/SecurityAdvisories/issues/44#issuecomment-368594409
Third Party Advisory
https://github.com/erusev/parsedown/pull/495
More from Parsedown
8.1
CVE-2019-10905
Parsedown before 1.7.2, when safe mode is used and HTML markup is disabled, might allow attackers to execute arbitrary JavaScript code if a script (already running on the affected…