CVE-2024-41662: Markdown It Missing Html Block Sanitization
Markdown-it is configured to override the `html_inline` renderer rule, but `html_block` is not being overridden. If `html_inline` is used to sanitize or filter XSS, failing to also sanitize `html_block` leaves the application vulnerable to XSS via block-level HTML tags (e.g., `<script>`, `<div>` with event handlers). Ensure `html_block` is sanitized alongsid
greprules fetch cve-2024-41662-markdown-it-missing-html-block-sanitization --engine opengrepDescription
Markdown-it is configured to override the `html_inline` renderer rule, but `html_block` is not being overridden. If `html_inline` is used to sanitize or filter XSS, failing to also sanitize `html_block` leaves the application vulnerable to XSS via block-level HTML tags (e.g., `<script>`, `<div>` with event handlers). Ensure `html_block` is sanitized alongsid
Detection target
Not provided
Recommended fix
Not provided
False-positive notes
Not provided
Community feedback
Sign in to report false positives, mark this rule useful, or suggest metadata improvements.