CVE-2018-20583
CVE-2018-20583
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Cross-site scripting (XSS) vulnerability in the PHP League CommonMark library versions 0.15.6 through 0.18.x before 0.18.1 allows remote attackers to insert unsafe URLs into HTML (even if allow_unsafe_links is false) via a newline character (e.g., writing javascript as javascri%0apt).
CVSS 6.1 · Medium · EPSS 1.9% · Fix available
- Published
- Updated
Stack: php
Affected products and versions
n/a
- Versions
- n/a: Affected
No fix published
league/commonmark Packagist
- Versions
- 0.15.6
- 0.15.7
- 0.16.0
- 0.17.0
- 0.17.1
- 0.17.2
- 0.17.3
- 0.17.4
- 0.17.5
- 0.18.0
- Affected ranges
- ECOSYSTEM: ≥ 0.15.6, < 0.18.1
Update to 0.18.1