1 line
1.6 KiB
JSON
1 line
1.6 KiB
JSON
{"schema_version":"1.7.3","id":"RUSTSEC-2021-0063","published":"2021-05-04T12:00:00Z","modified":"2023-11-08T04:06:25.615713Z","aliases":["CVE-2021-38186","GHSA-6wj2-g87r-pm62"],"summary":"XSS in `comrak`","details":"[comrak](https://github.com/kivikakk/comrak) operates by default in a \"safe\"\nmode of operation where unsafe content, such as arbitrary raw HTML or URLs with\nnon-standard schemes, are not permitted in the output. This is per the\nreference GFM implementation, [cmark-gfm](https://github.com/github/cmark).\n\nAmpersands were not being correctly escaped in link targets, making it possible\nto fashion unsafe URLs using schemes like `data:` or `javascript:` by entering\nthem as HTML entities, e.g. `data:`. The intended\nbehaviour, demonstrated upstream, is that these should be escaped and therefore\nharmless, but this behaviour was broken in comrak.","affected":[{"package":{"name":"comrak","ecosystem":"crates.io","purl":"pkg:cargo/comrak"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.10.1"}]}],"ecosystem_specific":{"affected_functions":null,"affects":{"arch":[],"functions":[],"os":[]}},"database_specific":{"categories":["format-injection"],"cvss":null,"informational":null,"source":"https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2021-0063.json"}}],"references":[{"type":"PACKAGE","url":"https://crates.io/crates/comrak"},{"type":"ADVISORY","url":"https://rustsec.org/advisories/RUSTSEC-2021-0063.html"},{"type":"WEB","url":"https://github.com/kivikakk/comrak/releases/tag/0.10.1"}],"database_specific":{"license":"CC0-1.0"}} |