CVE-2014-10065

MEDIUM

remarkable < 1.4.1 - Cross-Site Scripting via JavaScript URL Injection

Title source: llm

Description

Certain input when passed into remarkable before 1.4.1 will bypass the bad protocol check that disallows the javascript: scheme allowing for javascript: url's to be injected into the rendered content.

References (2)

Core 2

Core References

Third Party Advisory x_refsource_misc

https://github.com/jonschlinkert/remarkable/issues/97

Exploit, Third Party Advisory x_refsource_misc

https://nodesecurity.io/advisories/30

Scores

CVSS v3 6.1

EPSS 0.0097

EPSS Percentile 57.6%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Details

CWE

CWE-79 CWE-94

Status published

Products (2)

npm/remarkable 0 - 1.4.1npm

remarkable_project/remarkable < 1.4.1

Published May 31, 2018

Tracked Since Feb 18, 2026