Filtered by vendor Parsedown Subscriptions
Filtered by product Parsedown Subscriptions
Total 2 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2018-1000162 1 Parsedown 1 Parsedown 2024-08-05 N/A
Parsedown version prior to 1.7.0 contains a Cross Site Scripting (XSS) vulnerability in `setMarkupEscaped` for escaping HTML that can result in JavaScript code execution. This attack appears to be exploitable via specially crafted markdown that allows it to side step HTML escaping by breaking AST boundaries. This vulnerability appears to have been fixed in 1.7.0 and later.
CVE-2019-10905 1 Parsedown 1 Parsedown 2024-08-04 N/A
Parsedown before 1.7.2, when safe mode is used and HTML markup is disabled, might allow attackers to execute arbitrary JavaScript code if a script (already running on the affected page) executes the contents of any element with a specific class. This occurs because spaces are permitted in code block infostrings, which interferes with the intended behavior of a single class name beginning with the language- substring.