CVE-2021-39199
📋 TL;DR
CVE-2021-39199 is a critical cross-site scripting (XSS) vulnerability in the remark-html Node.js library that converts Markdown to HTML. The library incorrectly claimed to be safe by default but actually passed user input unsanitized, allowing attackers to inject arbitrary HTML/JavaScript. Any application using vulnerable versions of remark-html to process untrusted Markdown content is affected.
💻 Affected Systems
- remark-html
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full account takeover, session hijacking, credential theft, and complete compromise of user accounts through malicious JavaScript execution in victim browsers.
Likely Case
Attackers inject malicious scripts that steal session cookies, redirect users to phishing sites, or perform actions on behalf of authenticated users.
If Mitigated
No impact if proper input sanitization is enabled or patched versions are used.
🎯 Exploit Status
XSS exploitation is well-understood and requires minimal technical skill. The advisory includes examples of malicious payloads.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 13.0.2 and 14.0.1
Vendor Advisory: https://github.com/remarkjs/remark-html/security/advisories/GHSA-9q5w-79cv-947m
Restart Required: No
Instructions:
1. Update remark-html to version 13.0.2 or 14.0.1 using npm: npm update remark-html. 2. Verify the update with npm list remark-html. 3. Test Markdown processing functionality.
🔧 Temporary Workarounds
Enable sanitization in configuration
allManually enable HTML sanitization in remark-html configuration for versions before 13.0.2/14.0.1
Configure remark-html with {sanitize: true} option
🧯 If You Can't Patch
- Implement strict input validation and output encoding at the application layer
- Deploy a web application firewall (WAF) with XSS protection rules
🔍 How to Verify
Check if Vulnerable:
Check package.json or run npm list remark-html to see if version is below 13.0.2 or 14.0.1Check Version:
npm list remark-htmlVerify Fix Applied:
Confirm version is 13.0.2 or higher (13.x) or 14.0.1 or higher (14.x) using npm list remark-html📡 Detection & Monitoring
Log Indicators:
- Unusual HTML/JavaScript patterns in Markdown input logs
- Multiple failed sanitization attempts
Network Indicators:
- HTTP requests containing suspicious script tags in Markdown payloads
SIEM Query:
source="web_logs" AND ("<script" OR "javascript:" OR "onerror=" OR "onload=") AND path="*markdown*"🔗 References
- https://github.com/remarkjs/remark-html/commit/b75c9dde582ad87ba498e369c033dc8a350478c1
- https://github.com/remarkjs/remark-html/releases/tag/14.0.1
- https://github.com/remarkjs/remark-html/security/advisories/GHSA-9q5w-79cv-947m
- https://www.npmjs.com/package/remark-html
- https://github.com/remarkjs/remark-html/commit/b75c9dde582ad87ba498e369c033dc8a350478c1
- https://github.com/remarkjs/remark-html/releases/tag/14.0.1
- https://github.com/remarkjs/remark-html/security/advisories/GHSA-9q5w-79cv-947m
- https://www.npmjs.com/package/remark-html
