Vulnerabilities

TI-2019-09010 CVE-2019-12043 · GHSA-36m4-6v6m-4vpr

In remarkable 1.7.1, lib/parser_inline.js mishandles URL filtering, which allows…

LOW 29

In remarkable 1.7.1, lib/parser_inline.js mishandles URL filtering, which allows attackers to trigger XSS via unprintable characters, as demonstrated by a \x0ejavascript: URL.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.00865 Published 2019-05-13 Fixed in 1.7.2 CWE-79

TI-2019-09008 CVE-2019-12041 · GHSA-q22g-8fr4-qpj4

lib/common/html_re.js in remarkable 1.7.1 allows Regular Expression Denial of Service (ReDoS) via a CDATA section.

LOW 36

lib/common/html_re.js in remarkable 1.7.1 allows Regular Expression Denial of Service (ReDoS) via a CDATA section.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01321 Published 2019-05-13 Fixed in 1.7.2 CWE-1333

TI-2017-11733 CVE-2017-16006 · GHSA-mrmf-qwxg-7c3h

Cross-site scripting in HackerOne remarkable node module

LOW 29

Remarkable is a markdown parser.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.00962 Published 2018-06-04 Fixed in 1.7.0 CWE-79

TI-2014-08221 CVE-2014-10065 · GHSA-f9vc-q3hh-qhfv

Code injection in HackerOne remarkable node module

LOW 29

Certain input when passed into remarkable before 1.4.1 will bypass the bad protocol check that disallows the javascript: scheme allowing for javascript: url's to be injected into the rendered content.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.00958 Published 2018-05-31 Fixed in 1.4.1 CWE-94

Vulnerabilities

Filters

In remarkable 1.7.1, lib/parser_inline.js mishandles URL filtering, which allows…

lib/common/html_re.js in remarkable 1.7.1 allows Regular Expression Denial of Service (ReDoS) via a CDATA section.

Cross-site scripting in HackerOne remarkable node module

Code injection in HackerOne remarkable node module