Incomplete blacklist vulnerability in marked 0.3.2 and earlier for Node.js allows remote attackers to conduct cross-site scripting (XSS) attacks via a vbscript tag in a link.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Marked | Marked_project | * | 0.3.2 (including) |
| Node-marked | Ubuntu | artful | * |
| Node-marked | Ubuntu | esm-apps/xenial | * |
| Node-marked | Ubuntu | trusty | * |
| Node-marked | Ubuntu | upstream | * |
| Node-marked | Ubuntu | utopic | * |
| Node-marked | Ubuntu | vivid | * |
| Node-marked | Ubuntu | wily | * |
| Node-marked | Ubuntu | xenial | * |
| Node-marked | Ubuntu | yakkety | * |
| Node-marked | Ubuntu | zesty | * |
References
- http://www.openwall.com/lists/oss-security/2015/01/23/2
- https://github.com/chjj/marked/issues/492
- https://github.com/evilpacket/marked/commit/3c191144939107c45a7fa11ab6cb88be6694a1ba
- https://nodesecurity.io/advisories/marked_vbscript_injection
- http://www.openwall.com/lists/oss-security/2015/01/23/2
- https://github.com/chjj/marked/issues/492
- https://github.com/evilpacket/marked/commit/3c191144939107c45a7fa11ab6cb88be6694a1ba
- https://nodesecurity.io/advisories/marked_vbscript_injection