Advisory Weakness Curation

Cross-Site Scripting in ngx-md Versions of `ngx-md` prior to 6.0.3 are vulnerable to Cross-Site Scripting. Links are not properly restricted to http/https and can contain JavaScript which may lead to arbitrary code execution. Markdown input such as `[Click Me](javascript:alert('Injected!'%29)` is rendered as a `Click Me` link that executes JavaScript. ## Recommendation Upgrade to version 6.0.3 or later.

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in ngx-md.