Most recent entries from all

cnvd-2018-11376

EUVD-2026-174133

fkie_cve-2014-10065

Certain input when passed into remarkable before 1.4.1 will bypass the bad protocol check that disallows the javascript: scheme allowing for javascript: url's to be injected into the rendered content.

GHSA-f9vc-q3hh-qhfv — Content Injection in remarkable

Affected: npm: remarkable

Versions 1.4.0 and earlier of `remarkable` are affected by a cross-site scripting vulnerability. This occurs because vulnerable versions of `remarkable` did not properly whitelist link protocols, and consequently allowed `javascript:` to be used.

### Proof of Concept

Markdown Source: ``` [link](<javascript:alert(1)>) ```

Rendered HTML: ``` <a href="javascript:alert(1)">link</a> ```

## Recommendation

Update to version 1.4.1 or later

Most recent entries from all

cnvd-2018-11376

EUVD-2026-174133

fkie_cve-2014-10065

GHSA-f9vc-q3hh-qhfv — Content Injection in remarkable

gsd-2014-10065