Certain input when passed into remarkable before 1.4.1 will bypass the bad protocol check that disallows the javascript: scheme allowing for javascript: url's to be injected into the rendered content.

Affected: npm: remarkable

Versions 1.4.0 and earlier of `remarkable` are affected by a cross-site scripting vulnerability. This occurs because vulnerable versions of `remarkable` did not properly whitelist link protocols, and consequently allowed `javascript:` to be used.

### Proof of Concept

Markdown Source: ``` [link](<javascript:alert(1)>) ```

Rendered HTML: ``` <a href="javascript:alert(1)">link</a> ```

## Recommendation

Update to version 1.4.1 or later