RUSTSEC-2021-0026: XSS in `comrak`

Open github-actions[bot] opened this issue 3 years ago • 0 comments

XSS in comrak

Details
Package	`comrak`
Version	`0.7.0`
URL	https://github.com/kivikakk/comrak/releases/tag/0.9.1
Date	2021-02-21
Patched versions	`>=0.9.1`

The comrak we were matching unsafe URL prefixes, such as data: or javascript: , in a case-sensitive manner. This meant prefixes like Data: were untouched.

See advisory page for additional details.

Jun 02 '22 05:06 github-actions[bot]