Description (CNA)
In the @digitalocean/do-markdownit package through 1.16.1 (in npm), the callout and fence_environment plugins perform .includes substring matching if allowedClasses or allowedEnvironments is a string (instead of an array).
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| DigitalOcean / @digitalocean/do-markdownit | affected 0 through 1.16.1 |
CWE
CWE-843
References
- https://github.com/digitalocean/do-markdownit
- https://gist.github.com/thesmartshadow/dd19665f1f51a4e3c7a766e70c9eafd0
- https://www.npmjs.com/package/@digitalocean/do-markdownit
ADP enrichment
No English description supplied.