XSS using crafted markdown link
Current version of Framemo is vulnerable to an XSS attack
How to reproduce
- A malicious user creates an memo
- In a note (for example the options names), (s)he enters:
[my link](javascript:alert('xss'))
- The targeted user visits the note and clicks on the malicious link
- The JS payload is executed
How to fix
Updating the marked
library in order to include this PR should fix it.