CVE-2018-19057 - SimpleMDE 1.11.2 has XSS via an onerror attribute of a crafted IMG element, or via certain input with [ and ( characters, which is mishandled during construction of an A element

Back Back to CVE browser

MEDIUM

SimpleMDE 1.11.2 has XSS via an onerror attribute of a crafted IMG element, or via certain input with [ and ( characters, which is mishandled during construction of an A element

Published Nov 7, 2018

6.1

MEDIUM

CVSS 3.0

EPSS 0.79%

Description

SimpleMDE 1.11.2 has XSS via an onerror attribute of a crafted IMG element, or via certain input with [ and ( characters, which is mishandled during construction of an A element.

Affected products

Ecosystem	Package	Introduced	Fixed
npm	simplemde	0	not fixed

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (3)

https://github.com/advisories/GHSA-wg85-p6j7-gp3w
Advisory
https://github.com/sparksuite/simplemde-markdown-editor/issues/721
x_refsource_MISCExploitIssue TrackingThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2018-19057

Link	Providers	Tags
https://github.com/advisories/GHSA-wg85-p6j7-gp3w		Advisory
https://github.com/sparksuite/simplemde-markdown-editor/issues/721		x_refsource_MISCExploitIssue TrackingThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2018-19057