OMGeeky/advisory-db
1
0
Fork 0
mirror of https://github.com/OMGeeky/advisory-db.git synced 2026-02-13 21:18:11 +01:00
Code Issues Packages Projects Releases Wiki Activity
Files
0133e8aca67780dcbe7cd3cd771ead7964f1538d
advisory-db/crates/comrak/RUSTSEC-2021-0026.md
Yechan Bae b724f12a5b Update CVE numbers (#777) 
* Update CVE numbers

* Fix RUSTSEC-2020-0093

* Add another alias for async-h1 crate
2021-02-25 20:00:25 -05:00

486 B
Raw Blame History 

[advisory]
id = "RUSTSEC-2021-0026"
package = "comrak"
aliases = ["CVE-2021-27671"]
date = "2021-02-21"
url = "https://github.com/kivikakk/comrak/releases/tag/0.9.1"
categories = ["format-injection"]
keywords = ["xss"]

[versions]
patched = [">= 0.9.1"]

XSS in comrak

The comrak we were matching unsafe URL prefixes, such as data: or javascript: , in a case-sensitive manner. This meant prefixes like Data: were untouched.