Code blocks not escaping HTML when lacking a language identifier

High

brussell98 published GHSA-9r27-994c-4xch

Feb 20, 2020

Package

discord-markdown (npm)

Affected versions

< 2.3.0

Patched versions

2.3.1

Description

Impact

Any website using discord-markdown with user-generated markdown is vulnerable to having code injected into the page where the markdown is displayed.

Patches

This has been patched in version 2.3.1

Workarounds

Escape the characters <>& before sending plain code blocks to discord-markdown.

References