{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-09-24T03:57:41.701","vulnerabilities":[{"cve":{"id":"CVE-2020-7773","sourceIdentifier":"report@snyk.io","published":"2020-11-16T12:15:14.463","lastModified":"2026-06-17T03:25:25.287","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"This affects the package markdown-it-highlightjs before 3.3.1. It is possible insert malicious JavaScript as a value of lang in the markdown-it-highlightjs Inline code highlighting feature. const markdownItHighlightjs = require(\"markdown-it-highlightjs\"); const md = require('markdown-it'); const reuslt_xss = md() .use(markdownItHighlightjs, { inline: true }) .render('console.log(42){.\">js}'); console.log(reuslt_xss);"},{"lang":"es","value":"Esto afecta al paquete markdown-it-highlightjs versiones anteriores a 3.3.1. Es posible insertar JavaScript malicioso como valor de lang en la funcionalidad de resaltado de código en línea markdown-it-highlightjs. const markdownItHighlightjs = require(\"markdown-it-highlightjs\"); const md = require(\"markdown-it\"); const reuslt_xss = md() .use(markdownItHighlightjs, {inline: true}) .render(\"console.log(42){.\")js}'); console.log(reuslt_xss)"}],"affected":[{"source":"report@snyk.io","affectedData":[{"vendor":"n/a","product":"markdown-it-highlightjs","versions":[{"version":"unspecified","lessThan":"3.3.1","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"report@snyk.io","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.7}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-79"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:markdown-it-highlightjs_project:markdown-it-highlightjs:*:*:*:*:*:node.js:*:*","versionEndExcluding":"3.3.1","matchCriteriaId":"0E6E72E4-63FE-41AA-BBE5-19C53DD52AD1"}]}]}],"references":[{"url":"https://github.com/valeriangalliat/markdown-it-highlightjs/blob/v3.3.0/index.js%23L52","source":"report@snyk.io","tags":["Broken Link"]},{"url":"https://github.com/valeriangalliat/markdown-it-highlightjs/pull/14","source":"report@snyk.io","tags":["Exploit","Third Party Advisory"]},{"url":"https://snyk.io/vuln/SNYK-JS-MARKDOWNITHIGHLIGHTJS-1040461","source":"report@snyk.io","tags":["Mitigation","Third Party Advisory"]},{"url":"https://github.com/valeriangalliat/markdown-it-highlightjs/blob/v3.3.0/index.js%23L52","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Broken Link"]},{"url":"https://github.com/valeriangalliat/markdown-it-highlightjs/pull/14","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory"]},{"url":"https://snyk.io/vuln/SNYK-JS-MARKDOWNITHIGHLIGHTJS-1040461","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mitigation","Third Party Advisory"]}]}}]}