WaveDrom XSS Vulnerability: Arbitrary JS Execution via Untrusted Markdown Analysis

Vulnerability Overview This vulnerability involves the execution of arbitrary JavaScript code within WaveDrom rendering. Specifically, WaveDrom diagrams are rendered by evaluating untrusted Markdown content (such as ), which allows for arbitrary JavaScript execution. This issue affects all rendering paths, including real-time preview ( ), presentation mode, and HTML export (bundled / helper functions). Real-time preview now uses for parsing, and because malicious tags can be injected into Markdown within raw HTML, the HTML sanitizer now validates and normalizes each WaveDrom data script to insert strict JSON, thereby preventing any / from executing attacker-controlled code. Impact Scope WaveDrom Rendering: All rendering paths (real-time preview, presentation mode, HTML export) are affected. User Input: Any user input containing untrusted Markdown content can potentially trigger the vulnerability. Browser Environment: The vulnerability executes in the browser environment, potentially leading to Cross-Site Scripting (XSS) attacks. Remediation 1. Use for Parsing: Real-time preview now parses WaveDrom data using instead of executing JavaScript code directly. 2. HTML Sanitizer Validation: The HTML sanitizer now validates and normalizes each WaveDrom data script to ensure the content is strict JSON, preventing the injection of malicious code. 3. Remove / : The / mechanisms that could allow the execution of attacker-controlled code have been removed. POC Code Summary This vulnerability allows attackers to execute arbitrary JavaScript code via untrusted Markdown content, affecting all WaveDrom rendering paths. The remediation includes using for parsing, HTML sanitizer validation, and removing / to prevent malicious code execution.

Goal Reached Thanks to every supporter — we hit 100%!

WaveDrom XSS Vulnerability: Arbitrary JS Execution via Untrusted Markdown Analysis

More from this source