Marp Core (@marp-team/marp-core
) from v3.0.2 to v3.9.0 and v4.0.0, are vulnerable to cross-site scripting (XSS) due to improper neutralization of HTML sanitization.
Marp Core includes an HTML sanitizer with allowlist support. In the affected versions, the built-in allowlist is enabled by default. When the allowlist is active, if insufficient HTML comments are included, the sanitizer may fail to properly sanitize HTML content and lead cross-site scripting (XSS).
Marp Core v3.9.1 and v4.0.1 have been patched to fix that.
If you are unable to update the package immediately, disable all HTML tags by setting html: false
option in the Marp
class constructor.
const marp = new Marp({ html: false })
Thanks to @Ry0taK for finding out this vulnerability.
{ "nvd_published_at": "2024-12-26T21:15:06Z", "cwe_ids": [ "CWE-79" ], "severity": "MODERATE", "github_reviewed": true, "github_reviewed_at": "2024-12-26T18:25:25Z" }