Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Go package

github.com/k1LoW/mo

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Low, CVSS 2.3GoPublished

    mo has a XSS via inline SVG script tags in Markdown rendering

    GHSA-vccx-p757-pv6h

    Affected
    • Go github.com/k1LoW/mo <= 0.18.4
    Fixed in
    0.18.5· Vendor fix available
    Issue
    When rendering Markdown files containing inline SVG elements with <script tags, the embedded JavaScript is executed in the browser. This is due to rehype-raw passing raw HTML (including SVG) through to the DOM without sanitization. PoC Embedding the above in a Markdown file opened with mo causes the script to execute. Impact Arbitrary JavaScript execution in the context of the mo application when a user opens a malicious Markdown file. This could lead to data exfiltration of other opened Markdown file contents. Remediation Fixed by adding rehype-sanitize to the Markdown rendering pipeline, which strips dangerous elements such as <script while preserving safe HTML.

    Recommended action: Upgrade to 0.18.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →