Vulnerability Details

Hi, I want to report a possible XSS due to a misconfiguration in markmap-lib. The following configuration will render user input as HTML

This can allow a malicious attacker to specify a malicious HTML payload, such as

<img src=x onerror=alert(window.origin)>

You can verify this vulnerability exists by navigating to the markmap REPL and type the following payload

- xss: <img src=x onerror=alert(window.origin)>

An alert box should pop up with the domain of the website, indicating a XSS vulnerability

This also leads to a XSS vulnerability in another application that uses markmap-lib, which can be found in this issue

Mitigation

Markmap can sanitize the final HTML input from the user, or restrict the HTML tags that can be specified inside the markdown