FeedBagel

All Topics

Art

Fixing `marked` XSS vulnerability

10y agoen

programming

Source

SnykFixing `marked` XSS vulnerabilitysnyk.io

Snippet from the RSS feed

A recently published vulnerability in the npm `marked` package shows how attackers can use the flexibility of the Markdown format to introduce Cross-Site Scripting vulnerabilities. This post explains the issue and the fix, and discusses the difficulty of sanitizing complex user input.

You might also wanna read

Post-mortem Analysis of @ctrl/tinycolor npm Supply Chain Attack via GitHub Actions

A detailed post-mortem analysis of a supply chain attack on the @ctrl/tinycolor npm package. The attack occurred when a malicious GitHub Act

sigh.dev·9mo ago

Scratch's ongoing security challenges with SVG sanitization

The article discusses the security challenges Scratch faces with SVG sanitization. Scratch parses user-generated (attacker-controlled) SVG c

muffin.ink·2mo ago

Popular npm packages debug and chalk compromised with crypto-intercepting malware

Starting September 8th, 2023, the popular npm packages "debug" and "chalk" were compromised with malicious code. These packages, which colle

aikido.dev·10mo ago

Understanding Nested Code Fences in Markdown: Technical Implementation Guide

This article explores the technical challenge of nesting code fences within Markdown documents, focusing on the CommonMark specification and

susam.net·5mo ago

September 2025 NPM supply-chain attack compromises popular JavaScript packages

In September 2025, a coordinated software supply-chain attack targeted multiple popular NPM packages in the JavaScript ecosystem. The attack

projectptixiakis.github.io·1mo ago

Security Researchers Discover Critical XSS Vulnerabilities in Mintlify Platform Affecting Major Tech Companies

A 16-year-old hacker and his friends discovered critical cross-site scripting vulnerabilities in Mintlify, an AI documentation platform used

gist.github.com·6mo ago

Comments

No comments yet. Be the first.