This project is archived. Its data is read-only.
XSS using crafted markdown link
Current version of Framemo is vulnerable to an XSS attack ## How to reproduce - A malicious user creates an memo - In a note (for example the options names), (s)he enters: `[my link](javascript:alert('xss'))` - The targeted user visits the note and clicks on the malicious link - The JS payload is executed ## How to fix Updating the `marked` library in order to include [this PR](https://github.com/chjj/marked/pull/592) should fix it.
issue