Read the docs
TI-2023-13956 Aliases CVE-2023-29641GHSA-847g-34c5-vvm8

Cross Site Scripting (XSS) vulnerability in pandao editor.md thru 1.5.0 allows attackers…

Priority MEDIUM 60CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

Cross Site Scripting (XSS) vulnerability in pandao editor.md thru 1.5.0 allows attackers to inject arbitrary web script or HTML via crafted markdown text.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00429 37th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—editor.md (npm)up to 1.5.0—No fix listedGHSA-847g-34c5-vvm8
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • editor.md (npm) Vendor— Affected up to 1.5.0 Fixed in — No fix listed GHSA-847g-34c5-vvm8

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:ipandao:editor.md:*:*:*:*:*:*:*:*up to 1.5.0VulnerableIpandao
  • cpe:2.3:a:ipandao:editor.md:*:*:*:*:*:*:*:* Versions up to 1.5.0 Vulnerable ·Ipandao

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-29641
  2. 2026-10-03 Alias added: GHSA-847g-34c5-vvm8

References

Exploit 1

Advisory 1

Other 1

  • TI-2020-13680 Cross Site Scripting vulnerability found in Pandao Editor.md v.1.5.0 allows a remote… CVSS 3.1MEDIUM 6.1
  • TI-2020-13679 Cross Site Scripting vulnerability found in Pandao Editor.md v.1.5.0 allows a remote… CVSS 3.1MEDIUM 6.1
  • TI-2019-10886 pandao Editor.md 1.5.0 allows XSS via an attribute of an ABBR or SUP element. CVSS 3.0MEDIUM 6.1
  • TI-2019-07130 Editor.md 1.5.0 has DOM-based XSS via vectors involving the '<EMBED SRC="data:image/svg+xml' substring. CVSS 3.1MEDIUM 6.1
  • TI-2018-13507 pandao Editor.md 1.5.0 has DOM XSS via input starting with a "<<" substring, which is… CVSS 3.0MEDIUM 6.1
  • TI-2018-11696 Pandao Editor.md 1.5.0 allows XSS via crafted attributes of an invalid IMG element. CVSS 3.0MEDIUM 6.1
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences