CVSS: 8.7EPSS: 0%CPEs: 4EXPL: 0CVE-2020-26237 – Prototype Pollution in highlight.js
https://notcve.org/view.php?id=CVE-2020-26237
24 Nov 2020 — Highlight.js is a syntax highlighter written in JavaScript. Highlight.js versions before 9.18.2 and 10.1.2 are vulnerable to Prototype Pollution. A malicious HTML code block can be crafted that will result in prototype pollution of the base object's prototype during highlighting. If you allow users to insert custom HTML code blocks into your page/app via parsing Markdown code blocks (or similar) and do not filter the language names the user can provide you may be vulnerable. The pollution should just be har... • https://github.com/highlightjs/highlight.js/commit/7241013ae011a585983e176ddc0489a7a52f6bb0 • CWE-20: Improper Input Validation CWE-471: Modification of Assumed-Immutable Data (MAID) •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 1CVE-2020-7773 – Cross-site Scripting (XSS)
https://notcve.org/view.php?id=CVE-2020-7773
16 Nov 2020 — This affects the package markdown-it-highlightjs before 3.3.1. It is possible insert malicious JavaScript as a value of lang in the markdown-it-highlightjs Inline code highlighting feature. const markdownItHighlightjs = require("markdown-it-highlightjs"); const md = require('markdown-it'); const reuslt_xss = md() .use(markdownItHighlightjs, { inline: true }) .render('console.log(42){.">js}'); console.log(reuslt_xss); Esto afecta al paquete markdown-it-highlightjs versiones anteriores a 3.3.1. Es posibl... • https://github.com/valeriangalliat/markdown-it-highlightjs/blob/v3.3.0/index.js%23L52 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1CVE-2019-12934 – WP Code Highlight.js <= 0.6.2 - Cross-Site Request Forgery to Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2019-12934
19 Jul 2019 — An issue was discovered in the wp-code-highlightjs plugin through 0.6.2 for WordPress. wp-admin/options-general.php?page=wp-code-highlight-js allows CSRF, as demonstrated by an XSS payload in the hljs_additional_css parameter. Se detectó un problema en el plugin wp-code-highlightjs hasta versión 0.6.2 para WordPress. wp-admin/options-general.php?page=wp-code-highlight-js permite un vulnerabilidad de tipo CSRF, como es demostrado por una carga útil de tipo XSS en el parámetro hljs_additional_css. The WP Code... • http://www.securityfocus.com/bid/109331 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-352: Cross-Site Request Forgery (CSRF) •