GHSA-9r27-994c-4xch
discord-html not escaping HTML code blocks when lacking a language identifier
Impact
Any website using discord-markdown with user-generated markdown is vulnerable to having code injected into the page where the markdown is displayed.
Patches
This has been patched in version 2.3.1
Workarounds
Escape the characters <>& before sending plain code blocks to discord-markdown.
References
What each source reports
GitHub AdvisoriesNo score
discord-html not escaping HTML code blocks when lacking a language identifier
Impact
Any website using discord-markdown with user-generated markdown is vulnerable to having code injected into the page where the markdown is displayed.
Patches
This has been patched in version 2.3.1
Workarounds
Escape the characters <>& before sending plain code blocks to discord-markdown.
References
- Record
GHSA-9r27-994c-4xch- Updated
- 2026-11-02
OSVNo score
discord-html not escaping HTML code blocks when lacking a language identifier
Impact
Any website using discord-markdown with user-generated markdown is vulnerable to having code injected into the page where the markdown is displayed.
Patches
This has been patched in version 2.3.1
Workarounds
Escape the characters <>& before sending plain code blocks to discord-markdown.
References
- Record
GHSA-9r27-994c-4xch- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
discord-markdownnpm | before 2.3.1 | 2.3.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-9r27-994c-4xch is a vulnerability with no CVSS score yet in discord-markdown, published February 24, 2020. No source lists public exploit code. Fixed in discord-markdown 2.3.1.