Description
In remarkable 1.7.1, lib/parser_inline.js mishandles URL filtering, which allows attackers to trigger XSS via unprintable characters, as demonstrated by a \x0ejavascript: URL.
Remediation
References
https://github.com/jonschlinkert/remarkable/issues/332
Related Vulnerabilities
CVE-2017-16190 Vulnerability in npm package dcdcdcdcdc
CVE-2022-47105 Vulnerability in maven package org.jeecgframework.boot:jeecg-boot-base-core
CVE-2020-7712 Vulnerability in maven package org.webjars.npm:json
CVE-2023-37957 Vulnerability in maven package io.jenkins.plugins:pipeline-restful-api
CVE-2020-11009 Vulnerability in maven package org.rundeck:rundeck