CVE-2025-7969
📋 TL;DR
This XSS vulnerability in markdown-it allows attackers to inject malicious scripts into web pages generated by the library. It affects applications using markdown-it 14.1.0 for rendering user-controlled markdown content. The vendor disputes this is a vulnerability, but the CVSS score indicates moderate risk.
💻 Affected Systems
- markdown-it
📦 What is this software?
Markdown It by Markdown It Project
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal session cookies, perform actions as authenticated users, or redirect users to malicious sites when users view maliciously crafted markdown content.
Likely Case
Limited XSS attacks against users who view attacker-controlled markdown content, potentially leading to session hijacking or credential theft.
If Mitigated
With proper output encoding and Content Security Policy, impact is minimal as scripts would be blocked from execution.
🎯 Exploit Status
Exploitation requires user interaction (viewing malicious markdown) and depends on application context. No public exploits known.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 14.2.0 or later
Vendor Advisory: https://github.com/markdown-it/markdown-it/issues/1122
Restart Required: No
Instructions:
1. Update markdown-it package: npm update markdown-it
2. Verify version is 14.2.0 or higher
3. Test markdown rendering functionality
🔧 Temporary Workarounds
Input Sanitization
allSanitize all user-provided markdown before passing to markdown-it renderer
Content Security Policy
allImplement strict CSP headers to block inline script execution
🧯 If You Can't Patch
- Implement strict output encoding for all markdown-rendered content
- Disable markdown rendering for untrusted user input
🔍 How to Verify
Check if Vulnerable:
Check package.json or run: npm list markdown-itCheck Version:
npm list markdown-it | grep markdown-itVerify Fix Applied:
Verify markdown-it version is 14.2.0 or higher: npm list markdown-it📡 Detection & Monitoring
Log Indicators:
- Unusual markdown input patterns
- Multiple failed markdown parsing attempts
Network Indicators:
- Script tags in markdown content
- Unusual external resource loading from markdown
SIEM Query:
search 'markdown parsing error' OR 'script injection attempt' in application logs