Advisory Weakness Curation

VBScript Content Injection in marked Versions 0.3.2 and earlier of `marked` are affected by a cross-site scripting vulnerability even when `sanitize:true` is set. ## Proof of Concept ( IE10 Compatibility Mode Only ) `[xss link](vbscript:alert(1&#41;)` will get a link `<a href="vbscript:alert(1)">xss link</a>` ## Recommendation Update to version 0.3.3 or later.

VBScript Content Injection Marked is vulnerable to content injection even when `sanitize: true` is enabled. `[xss link](vbscript:alert(1&#41;)` will get a link `<a href="vbscript:alert(1)">xss link</a>` this script does not work in IE edge mode, but works in IE compatibility view.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Incomplete block list vulnerability in marked for Node.js allows remote attackers to conduct cross-site scripting (XSS) attacks via a vbscript tag in a link.