CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pReya External Markdown external-markdown allows Stored XSS.This issue affects External Markdown: from n/a through <= 0.0.1.
Explanation of Vulnerability in Simple Terms
External Markdown versions 0.0.1 and earlier contain a cross-site scripting (XSS) vulnerability. An attacker with low-level user privileges can inject malicious scripts into markdown content. When another user views the affected content, the script executes in their browser, potentially allowing the attacker to steal session tokens, modify page content, or perform actions on behalf of the victim.
What an attacker can do
Inject malicious scripts that execute in other users' browsers when they view markdown content.
Potential impact on your site
Users' sessions and data at risk if attackers inject scripts into markdown; site reputation damage if defaced.
Conditions required to exploit
Attacker needs low-level user account; victim must view the malicious markdown content.
Key dates
External resources
