CVE-2020-28455

HIGH 7.3EPSS 0.6%

This affects all versions of package markdown-it-toc. The title of the generated toc and the contents of the header are not escaped.

CVSS v3.1: 6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v3.1: 7.3 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS v3.1: 6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS: 0.58% chance of exploitation in the next 30 days, 46th percentile
Published: 2022-07-25
Updated: 2024-09-16

Proof-of-concept exploits (1)

https://security.snyk.io/vuln/SNYK-JS-MARKDOWNITTOC-1044067

References

Related