CVE-2024-21535: XSS
Versions of the package markdown-to-jsx before 7.4.0 are vulnerable to Cross-site Scripting (XSS) via the src property due to improper input sanitization. An attacker can execute arbitrary code by injecting a malicious iframe element in the markdown.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-21535?
CVE-2024-21535 is classified as a high severity vulnerability due to the potential for Cross-site Scripting (XSS) attacks.
How do I fix CVE-2024-21535?
To fix CVE-2024-21535, update the markdown-to-jsx package to version 7.4.0 or later.
What types of attacks are possible with CVE-2024-21535?
CVE-2024-21535 allows attackers to execute arbitrary code via XSS by injecting malicious elements within the markdown.
Which versions are affected by CVE-2024-21535?
CVE-2024-21535 affects all versions of the markdown-to-jsx package prior to 7.4.0.
Who is the vendor associated with CVE-2024-21535?
CVE-2024-21535 is associated with the vendor Quantizor, which maintains the markdown-to-jsx package.