RubyGems redcarpet Markdown Parsing Cross Site Scripting Vulnerability

Bugtraq ID:	73952
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Apr 07 2015 12:00AM
Updated:	Apr 07 2015 12:00AM
Credit:	Daniel LeCheminant
Vulnerable:	vmg sundown 1.16.0 vmg redcarpet 3.2.2 Hoedown Hoedown 3.0.1
Not Vulnerable:	vmg redcarpet 3.2.3

RubyGems redcarpet Markdown Parsing Cross Site Scripting Vulnerability

To exploit this issue an attacker must entice an unsuspecting victim to follow a malicious URI.

RubyGems redcarpet Markdown Parsing Cross Site Scripting Vulnerability

References:

• A bug in the Sundown and Redcarpet markdown parsers may lead to XSS (Daniel LeCheminant)
  
• Avoid rewinding previous inline when auto-linking (vmg)
  
• Markdown parsing issue enables insertion of malicious tags and event handlers (HackerOne)
  
• redcarpet Product Page (vmg)