simple-markdown.js in Khan Academy simple-markdown before 0.4.4 allows XSS via a data: or vbscript: URI.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - simple-markdown.js in Khan Academy simple-markdown before 0.4.4 allows XSS via a data: or vbscript: URI.
    (CVE-2019-9844)

Update to latest upstream release, fix CVE-2019-9844 (rhbz#1695304,

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
422919	SCA: security update for simple-markdown (GHSA-qj3f-9gmq-fwv5)	Tenable Cloud Security	SCA Checks	medium
422919	SCA: security update for simple-markdown (GHSA-qj3f-9gmq-fwv5)	Tenable Self-Hosted Container Security	SCA Checks	medium
124534	Fedora 30 : nodejs-simple-markdown (2019-bce274cbf6)	Nessus	Fedora Local Security Checks	medium
124042	Fedora 28 : nodejs-simple-markdown (2019-8e7c71f45b)	Nessus	Fedora Local Security Checks	medium
124041	Fedora 29 : nodejs-simple-markdown (2019-36ce1cb623)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2019-9844

medium

Tenable Plugins

medium

medium

medium

medium

medium