GHSA-xr53-m937-jr9c
Cross-Site Scripting in ngx-md
GHSA-xr53-m937-jr9c is a vulnerability with no CVSS score yet in ngx-md, published September 3, 2020. No source lists public exploit code. Fixed in ngx-md 6.0.3.
- Severity
- UnratedNo CVSS score yet
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
6.0.3ngx-md
Description
Versions of ngx-md prior to 6.0.3 are vulnerable to Cross-Site Scripting. Links are not properly restricted to http/https and can contain JavaScript which may lead to arbitrary code execution. Markdown input such as [Click Me](javascript:alert('Injected!'%29) is rendered as a Click Me link that executes JavaScript.
Recommendation
Upgrade to version 6.0.3 or later.
Affected packages
| Package | Affected | Fixed |
|---|---|---|
ngx-mdnpm | before 6.0.3 | 6.0.3 |
What each source reports
GitHub AdvisoriesNo score
Cross-Site Scripting in ngx-md
Versions of ngx-md prior to 6.0.3 are vulnerable to Cross-Site Scripting. Links are not properly restricted to http/https and can contain JavaScript which may lead to arbitrary code execution. Markdown input such as [Click Me](javascript:alert('Injected!'%29) is rendered as a Click Me link that executes JavaScript.
Recommendation
Upgrade to version 6.0.3 or later.
- Record
GHSA-xr53-m937-jr9c- Weakness
- CWE-79
- Updated
- 2026-11-02
OSVNo score
Cross-Site Scripting in ngx-md
Versions of ngx-md prior to 6.0.3 are vulnerable to Cross-Site Scripting. Links are not properly restricted to http/https and can contain JavaScript which may lead to arbitrary code execution. Markdown input such as [Click Me](javascript:alert('Injected!'%29) is rendered as a Click Me link that executes JavaScript.
Recommendation
Upgrade to version 6.0.3 or later.
- Record
GHSA-xr53-m937-jr9c- Weakness
- CWE-79
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.