quantizor/markdown-to-jsx

quantizor/markdown-to-jsx

GitHubGitHub
GitHubgithub.com
markdown-to-jsx.quantizor.devmarkdown-to-jsx.quantizor.dev
Releases167
Frequency3 weeks 1 day
Last Release
Stars2.37K
A very fast and versatile markdown toolchain. Output to AST, React, React Native, SolidJS, Vue, HTML, and more!
Log in to subscribe

CVE History

CVEPublishedCVSS v3CVSS v2
CVE-2024-56082↗
3.5 LOW—

ChatBar.tsx in Lumos before 1.0.17 parses raw HTML in Markdown because the markdown-to-jsx package is used without disableParsingRawHTML set to true.

CVE-2024-21535↗
6.1 MEDIUM—

Versions of the package markdown-to-jsx before 7.4.0 are vulnerable to Cross-site Scripting (XSS) via the src property due to improper input sanitization. An attacker can execute arbitrary code by injecting a malicious iframe element in the markdown.