Read the docs
TI-2021-16584 Aliases CVE-2021-39199GHSA-9q5w-79cv-947m

Cross site scripting via unsafe defaults in remark-html

Priority MEDIUM 45CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

remark-html is an open source nodejs library which compiles Markdown to HTML. In affected versions the documentation of remark-html has mentioned that it was safe by default. In practice the default was never safe and had to be opted into. That is, user input was not sanitized. This means arbitrary HTML can be passed through leading to potential XSS attacks. The problem has been patched in 13.0.2 and 14.0.1: `remark-html` is now safe by default, and the implementation matches the documentation. On older affected versions, pass `sanitize: true` if you cannot update.

Why it matters now

EPSS 0.01075 65th percentileScored 2026-11-08
Fix Fixed remark-html (remarkjs): 14.0.1, 13.0.2remark-html (npm): 13.0.2, 14.0.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
remarkjsremark-html14.0.0 to before 14.0.1; before 13.0.214.0.1, 13.0.2Patch availableCNA
—remark-html (npm)before 13.0.213.0.2Patch availableGHSA-9q5w-79cv-947m
—remark-html (npm)14.0.0 to before 14.0.114.0.1Patch availableGHSA-9q5w-79cv-947m
  • remark-html Vendorremarkjs Affected 14.0.0 to before 14.0.1; before 13.0.2 Fixed in 14.0.1, 13.0.2 Patch available CNA
  • remark-html (npm) Vendor— Affected before 13.0.2 Fixed in 13.0.2 Patch available GHSA-9q5w-79cv-947m
  • remark-html (npm) Vendor— Affected 14.0.0 to before 14.0.1 Fixed in 14.0.1 Patch available GHSA-9q5w-79cv-947m

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:remark:remark-html:*:*:*:*:*:node.js:*:*before 13.0.2; 14.0.0 to before 14.0.1VulnerableRemark
  • cpe:2.3:a:remark:remark-html:*:*:*:*:*:node.js:*:* Versions before 13.0.2; 14.0.0 to before 14.0.1 Vulnerable ·Remark

Remediation

  • Fix · CNA remark-html (remarkjs) Fixed in 14.0.1, 13.0.2
  • Fix · GHSA-9q5w-79cv-947m remark-html (npm) Fixed in 13.0.2 Advisory →
  • Fix · GHSA-9q5w-79cv-947m remark-html (npm) Fixed in 14.0.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-39199
  2. 2026-10-03 Alias added: GHSA-9q5w-79cv-947m

References

Patch 3

Advisory 2

Other 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences