PT-2018-9595 · Cebe · Cebe Markdown Parser

Ekultek · Published 2018-12-20 · Updated 2024-08-05 · CVE-2018-1000874

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: cebe markdown parser versions 1.2.0 and earlier

Description: The issue allows a maliciously crafted script to be executed, potentially resulting in the loss of user data and sensitive user information. This can be exploited by crafting a three backtick wrapped payload with a character in front, such as "<script>alert();</script>".

Recommendations: For cebe markdown parser versions 1.2.0 and earlier, consider sanitizing user input to prevent malicious code execution until a fix is available. As a temporary workaround, restrict the use of the markdown parser for untrusted input to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2018-1000874

Affected Products

Cebe Markdown Parser

References · 4

• 🔥 https://github.com/cebe/markdown/issues/166 · Exploit
• https://osv.dev/vulnerability/CVE-2018-1000874 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-1000874 · Security Note
• https://github.com/cebe/markdown/issues/166#issuecomment-508230493 · Note