XSS via unescaped code for unsupported languages in @astrojs/prism.

MediumGHSA-ff38-p3qj-4pmf28 Oct · yesterday
Source

Does it affect you?

0/4All must holdTicks stay in this browser
Conditions read by Claude. The sources remain the reference.Maintainer advisory

Timeline

28 Oct
16 hahead of the GitHub database so far
  1. Published by the maintainer in withastro/astro28 Oct, 19:27 UTC
  2. Seen by Patchwire +29 min28 Oct, 19:56 UTC
  3. Not in the GitHub database 16 h later29 Oct, 11:55 UTC
@astrojs/prism4.1.2
@astrojs/markdoc2.1.2

Versions of @astrojs/prism

4.x
safe 4.1.2
AffectedSafe

Versions of @astrojs/markdoc

2.x
safe 2.1.2
AffectedSafe

Packages

@astrojs/prism@astrojs/markdoc

Stacks

Not part of a tracked stack.