{"id":"CVE-2022-25849","aliases":["EUVD-2022-7018","GHSA-4r9g-w48q-8jwm"],"status":"published","title":"Cross-site Scripting (XSS)","description":"The package joyqi/hyper-down from 0.0.0 are vulnerable to Cross-site Scripting (XSS) because the module of parse markdown does not filter the href attribute very well.","severity":{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.0057,"percentile":0.47543,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2022-10-26T05:05:09Z","modified":"2026-06-17T04:34:23Z","affected":[{"source":"ghsa","ecosystem":"Packagist","package":"joyqi/hyper-down","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.4.27"}]}]},{"source":"osv","ecosystem":"Packagist","package":"joyqi/hyper-down","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.4.27"}]}],"versions":["2.4.10","2.4.13","2.4.14","2.4.15","2.4.16","2.4.17","2.4.18","2.4.19","2.4.20","2.4.21","2.4.23","2.4.24","2.4.25","2.4.26","2.4.27","2.4.9"]}],"products":[{"vendor":"hyperdown_project","product":"hyperdown"}],"references":[{"url":"https://security.snyk.io/vuln/SNYK-PHP-JOYQIHYPERDOWN-2953544","tags":["x_transferred","Exploit","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-25849","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-4r9g-w48q-8jwm"},{"url":"https://github.com/SegmentFault/HyperDown","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2022-25849","title":"Cross-site Scripting (XSS)","description":"The package joyqi/hyper-down from 0.0.0 are vulnerable to Cross-site Scripting (XSS) because the module of parse markdown does not filter the href attribute very well.","status":"published","published":"2022-10-26T05:05:09.395Z","modified":"2025-05-09T19:09:38.117Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:34:28.374916Z"}],"euvd":[{"id":"EUVD-2022-7018","description":"The package joyqi/hyper-down from 0.0.0 are vulnerable to Cross-site Scripting (XSS) because the module of parse markdown does not filter the href attribute very well.","status":"published","published":"2022-10-26T05:05:09Z","modified":"2025-05-09T19:09:38Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T20:32:50.201515Z"}],"ghsa":[{"id":"GHSA-4r9g-w48q-8jwm","title":"HyperDown vulnerable to Cross-site Scripting","description":"HyperDown is a markdown parser written for the Chinese website SegmentFault. Improper validation of the href attribute allows for Cross-site Scripting. At publication there are no patched versions, and no known workarounds.","status":"published","published":"2022-10-26T12:00:29Z","modified":"2023-02-01T05:04:28Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:36:32.120868Z"}],"nvd":[{"id":"CVE-2022-25849","description":"The package joyqi/hyper-down from 0.0.0 are vulnerable to Cross-site Scripting (XSS) because the module of parse markdown does not filter the href attribute very well.","status":"published","published":"2022-10-26T05:15:08.92Z","modified":"2026-06-17T04:34:23.173Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:07:31.127985Z"}],"osv":[{"id":"GHSA-4r9g-w48q-8jwm","title":"HyperDown vulnerable to Cross-site Scripting","description":"HyperDown is a markdown parser written for the Chinese website SegmentFault. Improper validation of the href attribute allows for Cross-site Scripting. At publication there are no patched versions, and no known workarounds.","status":"published","published":"2022-10-26T12:00:29Z","modified":"2023-11-08T04:08:49.07427Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:37.528068Z"}]}}