CVE-2017-16006

MEDIUM

remarkable < 1.6.2 - Cross-Site Scripting via Data URI Handling

Title source: llm

Description

Remarkable is a markdown parser. In versions 1.6.2 and lower, remarkable allows the use of `data:` URIs in links and can therefore execute javascript.

References (2)

Core 2

Core References

Exploit, Issue Tracking, Patch, Third Party Advisory x_refsource_misc

https://github.com/jonschlinkert/remarkable/issues/227

Exploit, Third Party Advisory x_refsource_misc

https://nodesecurity.io/advisories/319

Scores

CVSS v3 6.1

EPSS 0.0098

EPSS Percentile 58.4%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Details

CWE

CWE-79

Status published

Products (2)

npm/remarkable 0 - 1.7.0npm

remarkable_project/remarkable < 1.6.2

Published Jun 04, 2018

Tracked Since Feb 18, 2026