High, CVSS 8.1npmAmendedPublished
@tdurieux/anonymous_github Vulnerable to XSS via Unsanitized GitHub Repository Content Rendering in Anonymous GitHub Origin
GHSA-g485-8j3v-p6x8
- Affected
- npm @tdurieux/anonymous_github >= 2.2.0, <= 2.2.0
- Fixed in
- 2.3.0· Vendor fix available
- Issue
- Anonymous GitHub fetches repository content (e.g., markdown files) from GitHub's API and renders it without sanitization. On the client side, markdown is parsed with marked (with sanitize: false) and injected into the DOM via $sce.trustAsHtml() + ng-bind-html, bypassing AngularJS's built-in XSS protection. An attacker can craft a malicious GitHub repository whose README executes arbitrary JavaScript in the Anonymous GitHub origin. Details README fetched from GitHub API The server fetches the README via GitHub's REST API and stores the raw markdown in MongoDB: It is then served to the client with no sanitization: Client-side rendering via $sce.trustAsHtml() + ng-bind-html The client fetches the raw README, parses it with renderMD() (which uses marked with sanitize: false), then bypasses AngularJS sanitization: The renderMD() function explicitly disables sanitization: The resulting HTML is bound to the DOM via ng-bind-html, which trusts the string marked by $sce.trustAsHtml()…
Recommended action: Upgrade to 2.3.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.