Search

Find a vulnerability

Search criteria

    2 vulnerabilities by marp-team

    CVE-2024-56510 (GCVE-0-2024-56510)

    Vulnerability from nvd – Published: 2024-12-26 20:56 – Updated: 2024-12-27 16:47
    VLAI
    Title
    Marp Core allows XSS by improper neutralization of HTML sanitization
    Summary
    @marp-team/marp-core is the core for Marp, which is the ecosystem to write your presentation with plain Markdown. Marp Core from v3.0.2 to v3.9.0 and v4.0.0, are vulnerable to cross-site scripting (XSS) due to improper neutralization of HTML sanitization. Marp Core v3.9.1 and v4.0.1 have been patched to fix that. If you are unable to update the package immediately, disable all HTML tags by setting html: false option in the Marp class constructor.
    Severity
    5.3 (Medium)
    CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator (v2.0.3)
    CWE
    • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
    Assigner
    References
    Impacted products
    Vendor Product Version
    marp-team marp-core Affected: >= 3.0.2, < 3.9.1
    Affected: >= 4.0.0, < 4.0.1
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-56510",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-12-27T16:46:58.692989Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-12-27T16:47:08.602Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "marp-core",
          "vendor": "marp-team",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 3.0.2, \u003c 3.9.1"
            },
            {
              "status": "affected",
              "version": "\u003e= 4.0.0, \u003c 4.0.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "@marp-team/marp-core is the core for Marp, which is the ecosystem to write your presentation with plain Markdown. Marp Core from v3.0.2 to v3.9.0 and v4.0.0, are vulnerable to cross-site scripting (XSS) due to improper neutralization of HTML sanitization. Marp Core v3.9.1 and v4.0.1 have been patched to fix that. If you are unable to update the package immediately, disable all HTML tags by setting html: false option in the Marp class constructor."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-12-26T20:56:24.743Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/marp-team/marp-core/security/advisories/GHSA-x52f-h5g4-8qv5",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/marp-team/marp-core/security/advisories/GHSA-x52f-h5g4-8qv5"
        },
        {
          "name": "https://github.com/marp-team/marp-core/pull/282",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/marp-team/marp-core/pull/282"
        },
        {
          "name": "https://github.com/marp-team/marp-core/commit/61a1def244d1b6faa8e2c0be97ec0b68cab3ab49",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/marp-team/marp-core/commit/61a1def244d1b6faa8e2c0be97ec0b68cab3ab49"
        },
        {
          "name": "https://github.com/marp-team/marp-core/releases/tag/v3.9.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/marp-team/marp-core/releases/tag/v3.9.1"
        },
        {
          "name": "https://github.com/marp-team/marp-core/releases/tag/v4.0.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/marp-team/marp-core/releases/tag/v4.0.1"
        }
      ],
      "source": {
        "advisory": "GHSA-x52f-h5g4-8qv5",
        "discovery": "UNKNOWN"
      },
      "title": "Marp Core allows XSS by improper neutralization of HTML sanitization"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-56510",
    "datePublished": "2024-12-26T20:56:24.743Z",
    "dateReserved": "2024-12-26T19:31:49.307Z",
    "dateUpdated": "2024-12-27T16:47:08.602Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2024-56510 (GCVE-0-2024-56510)

    Vulnerability from cvelistv5 – Published: 2024-12-26 20:56 – Updated: 2024-12-27 16:47
    VLAI
    Title
    Marp Core allows XSS by improper neutralization of HTML sanitization
    Summary
    @marp-team/marp-core is the core for Marp, which is the ecosystem to write your presentation with plain Markdown. Marp Core from v3.0.2 to v3.9.0 and v4.0.0, are vulnerable to cross-site scripting (XSS) due to improper neutralization of HTML sanitization. Marp Core v3.9.1 and v4.0.1 have been patched to fix that. If you are unable to update the package immediately, disable all HTML tags by setting html: false option in the Marp class constructor.
    Severity
    5.3 (Medium)
    CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator (v2.0.3)
    CWE
    • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
    Assigner
    References
    Impacted products
    Vendor Product Version
    marp-team marp-core Affected: >= 3.0.2, < 3.9.1
    Affected: >= 4.0.0, < 4.0.1
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-56510",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-12-27T16:46:58.692989Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-12-27T16:47:08.602Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "marp-core",
          "vendor": "marp-team",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 3.0.2, \u003c 3.9.1"
            },
            {
              "status": "affected",
              "version": "\u003e= 4.0.0, \u003c 4.0.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "@marp-team/marp-core is the core for Marp, which is the ecosystem to write your presentation with plain Markdown. Marp Core from v3.0.2 to v3.9.0 and v4.0.0, are vulnerable to cross-site scripting (XSS) due to improper neutralization of HTML sanitization. Marp Core v3.9.1 and v4.0.1 have been patched to fix that. If you are unable to update the package immediately, disable all HTML tags by setting html: false option in the Marp class constructor."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-12-26T20:56:24.743Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/marp-team/marp-core/security/advisories/GHSA-x52f-h5g4-8qv5",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/marp-team/marp-core/security/advisories/GHSA-x52f-h5g4-8qv5"
        },
        {
          "name": "https://github.com/marp-team/marp-core/pull/282",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/marp-team/marp-core/pull/282"
        },
        {
          "name": "https://github.com/marp-team/marp-core/commit/61a1def244d1b6faa8e2c0be97ec0b68cab3ab49",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/marp-team/marp-core/commit/61a1def244d1b6faa8e2c0be97ec0b68cab3ab49"
        },
        {
          "name": "https://github.com/marp-team/marp-core/releases/tag/v3.9.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/marp-team/marp-core/releases/tag/v3.9.1"
        },
        {
          "name": "https://github.com/marp-team/marp-core/releases/tag/v4.0.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/marp-team/marp-core/releases/tag/v4.0.1"
        }
      ],
      "source": {
        "advisory": "GHSA-x52f-h5g4-8qv5",
        "discovery": "UNKNOWN"
      },
      "title": "Marp Core allows XSS by improper neutralization of HTML sanitization"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-56510",
    "datePublished": "2024-12-26T20:56:24.743Z",
    "dateReserved": "2024-12-26T19:31:49.307Z",
    "dateUpdated": "2024-12-27T16:47:08.602Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}