https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 23:05:58 +0000 https://vulnerability.circl.lu/vuln/cve-2015-1370 <p>Incomplete blacklist vulnerability in marked 0.3.2 and earlier for Node.js allows remote attackers to conduct cross-site scripting (XSS) attacks via a vbscript tag in a link.</p> <p>Incomplete blacklist vulnerability in marked 0.3.2 and earlier for Node.js allows remote attackers to conduct cross-site scripting (XSS) attacks via a vbscript tag in a link.</p> https://vulnerability.circl.lu/vuln/cve-2015-1370 https://vulnerability.circl.lu/vuln/ghsa-cfjh-p3g4-3q2f <p><strong>Affected:</strong> npm: marked</p> <p>Versions 0.3.2 and earlier of `marked` are affected by a cross-site scripting vulnerability even when `sanitize:true` is set.</p> <p>## Proof of Concept ( IE10 Compatibility Mode Only )</p> <p>`[xss link](vbscript:alert(1&amp;#41;)`</p> <p>will get a link</p> <p>`&lt;a href=&#34;vbscript:alert(1)&#34;&gt;xss link&lt;/a&gt;`</p> <p>## Recommendation</p> <p>Update to version 0.3.3 or later.</p> <p><strong>Affected:</strong> npm: marked</p> <p>Versions 0.3.2 and earlier of `marked` are affected by a cross-site scripting vulnerability even when `sanitize:true` is set.</p> <p>## Proof of Concept ( IE10 Compatibility Mode Only )</p> <p>`[xss link](vbscript:alert(1&amp;#41;)`</p> <p>will get a link</p> <p>`&lt;a href=&#34;vbscript:alert(1)&#34;&gt;xss link&lt;/a&gt;`</p> <p>## Recommendation</p> <p>Update to version 0.3.3 or later.</p> https://vulnerability.circl.lu/vuln/ghsa-cfjh-p3g4-3q2f