CVE-2025-46654
CodiMD through 2.2.0 has a CSP-based protection mechanism against XSS through uploaded JavaScript content, but it can be bypassed by uploading a .html...
Description d'origine
La description telle que publiée par la source (souvent en anglais).
CodiMD through 2.2.0 has a CSP-based protection mechanism against XSS through uploaded JavaScript content, but it can be bypassed by uploading a .html file that references an uploaded .js file.
Références
- advisory github.com
- advisory nvd.nist.gov
- report github.com
- web github.com