CVE-2014-10065

Certain input when passed into remarkable before 1.4.1 will bypass the bad protocol check that disallows the javascript: scheme allowing for javascript: url's to be injected into the rendered content.

Score

CVSS 3.0 6.1 Medium

Status

Modified - support@hackerone.com

Published

2018-05-31

Last modified

2024-09-16

Weaknesses

CWE-79, CWE-94

Affected products

• Remarkable Node Module (Hackerone)
• Remarkable (Remarkable Project)

References

• https://github.com/jonschlinkert/remarkable/issues/97
• https://nodesecurity.io/advisories/30