CVE-2024-56510

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2024-56510
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-56510.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2024-56510
Aliases
Published
2024-12-26T20:56:24Z
Modified
2025-11-11T02:49:54.394816Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L CVSS Calculator
Summary
Marp Core allows XSS by improper neutralization of HTML sanitization
Details

@marp-team/marp-core is the core for Marp, which is the ecosystem to write your presentation with plain Markdown. Marp Core from v3.0.2 to v3.9.0 and v4.0.0, are vulnerable to cross-site scripting (XSS) due to improper neutralization of HTML sanitization. Marp Core v3.9.1 and v4.0.1 have been patched to fix that. If you are unable to update the package immediately, disable all HTML tags by setting html: false option in the Marp class constructor.

Database specific 
{
    "cwe_ids": [
        "CWE-79"
    ]
}
References

Affected packages

Git / github.com/marp-team/marp-core

Affected ranges

Type
GIT
Repo
https://github.com/marp-team/marp-core
Events
Introduced
1d0210e116f0c6bf1dffbcafe1192c155f8058b9
Fixed
24a7dd4c2c5086cdf2e396785a681adf15e9cfd8
Database specific 
{
    "versions": [
        {
            "introduced": "3.0.2"
        },
        {
            "fixed": "3.9.1"
        }
    ]
}
Type
GIT
Repo
https://github.com/marp-team/marp-core
Events
Introduced
75ecf54b90775cd7fdf487bcfe8f62256fc94f2f
Fixed
36673d5f9c9b218f0c6084486288d6caefddafa6
Database specific 
{
    "versions": [
        {
            "introduced": "4.0.0"
        },
        {
            "fixed": "4.0.1"
        }
    ]
}

Affected versions

v3.*

v3.0.2
v3.1.0
v3.1.1
v3.1.2
v3.2.0
v3.2.1
v3.3.0
v3.3.1
v3.3.2
v3.3.3
v3.4.0
v3.4.1
v3.4.2
v3.5.0
v3.6.0
v3.7.0
v3.8.0
v3.8.1
v3.9.0

v4.*

v4.0.0