CVE-2024-21535

Summary

CVE-2024-21535 is a newly disclosed Cross-site Scripting (XSS) vulnerability affecting versions of the markdown-to-jsx package below 7.4.0. This issue arises from insufficient input sanitization in the 'src' property, enabling attackers to inject malicious iframe elements into markdown files. Successful exploitation of this vulnerability may result in the execution of arbitrary code, posing a significant risk to applications using the affected package. To mitigate this threat, it's essential to upgrade to the latest version of markdown-to-jsx as soon as possible.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.