discord-html not escaping HTML code blocks when lacking a language identifier
High severity
GitHub Reviewed
Published
Feb 20, 2020
in
brussell98/discord-markdown
•
Updated Jan 9, 2023
Description
Reviewed
Feb 21, 2020
Published to the GitHub Advisory Database
Feb 24, 2020
Last updated
Jan 9, 2023
Impact
Any website using discord-markdown with user-generated markdown is vulnerable to having code injected into the page where the markdown is displayed.
Patches
This has been patched in version 2.3.1
Workarounds
Escape the characters
<>&before sending plain code blocks to discord-markdown.References
brussell98/discord-markdown#13
References