CVE-2017-1000427: XSS
Published Jan 2, 2018
·Updated
marked version 0.3.6 and earlier is vulnerable to an XSS attack in the data: URI parser.
Affected Software
2 affected componentsFixes available
npm/marked<0.3.7
0.3.7
Marked Project Marked<=0.3.6
Remediation
Patch Available
Event History
Jan 2, 2018
CVE Published
via MITRE·11:00 PM
Data Sourced
via MITRE·11:00 PM
Description
Jan 4, 2018
Advisory Published
09:04 PM
Frequently Asked Questions
1
What is the severity of CVE-2017-1000427?
CVE-2017-1000427 is classified as a medium severity vulnerability due to its potential for XSS attacks.
2
How do I fix CVE-2017-1000427?
To fix CVE-2017-1000427, upgrade to marked version 0.3.7 or later.
3
What types of attacks does CVE-2017-1000427 expose users to?
CVE-2017-1000427 exposes users to cross-site scripting (XSS) attacks via the data: URI parser.
4
Which versions of marked are affected by CVE-2017-1000427?
Marked versions 0.3.6 and earlier are affected by CVE-2017-1000427.
5
Is CVE-2017-1000427 specific to any platform?
CVE-2017-1000427 is specific to the marked package used in Node.js applications.