PT-2018-5255 · Shiba · Shiba Markdown Live Preview App

Silviavali · Published 2018-01-03 · Updated 2022-05-14 · CVE-2017-1000491

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Shiba markdown live preview app version 1.1.0

Description The issue allows for XSS, leading to code execution due to enabled node integration.

Recommendations For version 1.1.0, disable node integration to prevent code execution until a patch is available.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2017-1000491

GHSA-JR64-PGGR-J8XJ

Affected Products

Shiba Markdown Live Preview App

References · 5

• https://github.com/rhysd/Shiba/commit/e8a65b0f81eb04903eedd29500d7e1bedf249eab · Patch
• https://osv.dev/vulnerability/CVE-2017-1000491 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-1000491 · Security Note
• https://osv.dev/vulnerability/GHSA-jr64-pggr-j8xj · Vendor Advisory
• https://github.com/rhysd/Shiba/issues/42 · Note