Parsedown version prior to 1.7.0 contains a Cross Site Scripting (XSS) vulnerability in `setMarkupEscaped` for escaping HTML that can result in JavaScript code execution. This attack appears to be exploitable via specially crafted markdown that allows it to side step HTML escaping by breaking AST boundaries. This vulnerability appears to have been fixed in 1.7.0 and later.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Parsedown version prior to 1.7.0 contains a Cross Site Scripting (XSS) vulnerability in `setMarkupEscaped`
    for escaping HTML that can result in JavaScript code execution. This attack appears to be exploitable via
    specially crafted markdown that allows it to side step HTML escaping by breaking AST boundaries. This
    vulnerability appears to have been fixed in 1.7.0 and later. (CVE-2018-1000162)

## 1.7.1

  - \#475: 'Loose' lists will now contain paragraphs in all     items, not just some.

  - \#433: Links will no longer be double nested

  - \#525: The info-string when beginning a code block may     now contain non-word characters (e.g. `c++`)

  - \#561: The `mbstring` extension (which we already depend     on) has been added explicitly to `composer.json`

  - \#563: The `Parsedown::version` constant now matches the     release version

  - \#560: Builds will now fail if we forget to update the     version constant again

## 1.7.0

CVE-2018-1000162

  - Merge pull request #495 from aidantwoods/anti-xss

  - Prevent various XSS attacks (rebase and update of #276)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
418128	SCA: security update for erusev/parsedown (GHSA-qgpv-86r3-87fh)	Tenable Cloud Security	SCA Checks	medium
418128	SCA: security update for erusev/parsedown (GHSA-qgpv-86r3-87fh)	Tenable Self-Hosted Container Security	SCA Checks	medium
122650	Fedora 28 : php-erusev-parsedown (2019-009fdcfb60)	Nessus	Fedora Local Security Checks	medium
122628	Fedora 29 : php-erusev-parsedown (2019-b02e9bf467)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2018-1000162

medium

Tenable Plugins

medium

medium

medium

medium