← CVE Intelligence

CVE-2024-38354

Cross-site Scripting in Hackmd.io Notes lead by HTML Injection PUBLISHED

Description (CNA)

CodiMD allows realtime collaborative markdown notes on all platforms. The notebook feature of Hackmd.io permits the rendering of iframe `HTML` tags with an improperly sanitized `name` attribute. This vulnerability enables attackers to perform cross-site scripting (XSS) attacks via DOM clobbering. This vulnerability is fixed in 2.5.4.

Affected (CNA)

Vendor / productVersions
hackmdio / codimdaffected < 2.5.4

CWE

CWE-79

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

CVE

No English description supplied.