PT-2024-36709 · Lumos+1 · Lumos+1

Edmpl · Published 2024-12-15 · Updated 2024-12-16 · CVE-2024-56082

Positive Technologies (AI Summary)

CVSS v3.1

3.5

Low

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Lumos versions prior to 1.0.17

Description The issue arises from the ChatBar.tsx component in Lumos, which parses raw HTML in Markdown. This occurs because the markdown-to-jsx package is used without setting disableParsingRawHTML to true.

Recommendations For versions prior to 1.0.17, update to version 1.0.17 or later to resolve the issue. As a temporary workaround, consider setting disableParsingRawHTML to true in the markdown-to-jsx package to prevent raw HTML parsing.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-56082

Affected Products

Lumos

Markdown-To-Jsx

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2024-56082 · Security Note
• https://osv.dev/vulnerability/CVE-2024-56082 · Vendor Advisory
• https://github.com/quantizor/markdown-to-jsx/blob/4fa87d89ad87f97b2d9e56cb969d12f9a838f3ac/README.md?plain=1#L535-L537 · Note
• https://github.com/andrewnguonly/Lumos/issues/193 · Note
• https://github.com/andrewnguonly/Lumos/releases/tag/1.0.17 · Note
• https://twitter.com/CVEnew/status/1868271097533088200 · Twitter Post
• https://t.me/cvenotify/104330 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1868169431269908928 · Twitter Post
• https://t.me/cvedetector/12952 · Telegram Post
• https://t.me/cvenotify/104394 · Telegram Post