PT-2020-21207 · Discord · Discord-Markdown

Published 2020-02-24 · Updated 2020-02-24

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions discord-markdown versions prior to 2.3.1

Description The issue affects websites that use discord-markdown with user-generated markdown, making them susceptible to code injection where the markdown is displayed.

Recommendations For versions prior to 2.3.1, update to version 2.3.1 to resolve the issue. As a temporary workaround, consider escaping the characters <, >, and & before sending plain code blocks to discord-markdown.

Related Identifiers

GHSA-9R27-994C-4XCH

Affected Products

Discord-Markdown

References · 4

• https://osv.dev/vulnerability/GHSA-9r27-994c-4xch · Vendor Advisory
• https://github.com/brussell98/discord-markdown/issues/13 · Note
• https://github.com/brussell98/discord-markdown/security/advisories/GHSA-9r27-994c-4xch · Note
• https://github.com/brussell98/discord-markdown/commit/7ce2eb66520815dcf5e97ef2bc8a2d5979da66e7 · Note