PT-2019-19831 · Pandao · Editor.Md

Yyhylho · Published 2019-03-13 · Updated 2020-01-06 · CVE-2019-9737

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Editor.md versions 1.5.0 and earlier Editor.md (all versions)

Description The issue involves a DOM-based XSS that can be triggered through specific vectors, including the '<EMBED SRC="data:image/svg+xml' substring. It is also reported that user input is not sufficiently sanitized, allowing attackers to inject malicious code, particularly in payloads containing base64-encoded content.

Recommendations For Editor.md version 1.5.0, consider disabling the embedding of SVG images until a fix is available. For all versions of Editor.md, consider using an alternative module until a fix is made available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-9737

GHSA-2J5V-FC74-J9Q2

Affected Products

Editor.Md

References · 6

• 🔥 https://github.com/pandao/editor.md/issues/662 · Exploit
• https://osv.dev/vulnerability/CVE-2019-9737 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-2j5v-fc74-j9q2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-9737 · Security Note
• https://npmjs.com/advisories/794 · Note
• https://github.com/advisories/GHSA-2j5v-fc74-j9q2 · Note