PatchTheCVEparsedown vulnerabilities and fixes
Recent CVEs affecting parsedown, with upgrade or downgrade steps. 2 tracked.
parsedown has 2 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 2. Most recent: 2019-04-06. Highest priority: CVE-2019-10905 (score 57/100).
- CVE-2019-10905 HIGH 8.1 UPGRADE Parsedown before 1.7.2, when safe mode is used and HTML markup is disabled, might allow attackers to execute a
- CVE-2018-1000162 MEDIUM 6.1 UPGRADE Parsedown version prior to 1.7.0 contains a Cross Site Scripting (XSS) vulnerability in `setMarkupEscaped` for
FAQ
How do I fix parsedown vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is parsedown being exploited right now?
None of the tracked parsedown CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which parsedown CVE should I patch first?
CVE-2019-10905 currently ranks highest (57/100): Parsedown before 1.7.2, when safe mode is used and HTML markup is disabled, might allow attackers to execute a.