Most recent entries from all

cnvd-2021-61406

EUVD-2026-30158

fkie_cve-2021-38186

An issue was discovered in the comrak crate before 0.10.1 for Rust. It mishandles & characters, leading to XSS via &# HTML entities.

GHSA-6wj2-g87r-pm62 — Cross-site Scripting in comrak

Affected: crates.io: comrak

An issue was discovered in the comrak crate before 0.10.1 for Rust. It mishandles & characters, leading to XSS via &# HTML entities.

gsd-2021-38186

RUSTSEC-2021-0063 — XSS in `comrak`

Affected: crates.io: comrak

[comrak](https://github.com/kivikakk/comrak) operates by default in a "safe" mode of operation where unsafe content, such as arbitrary raw HTML or URLs with non-standard schemes, are not permitted in the output. This is per the reference GFM implementation, [cmark-gfm](https://github.com/github/cmark).

Ampersands were not being correctly escaped in link targets, making it possible to fashion unsafe URLs using schemes like `data:` or `javascript:` by entering them as HTML entities, e.g. `&#x64&#x61&#x74&#x61&#x3a`. The intended behaviour, demonstrated upstream, is that these should be escaped and therefore harmless, but this behaviour was broken in comrak.