@astrojs/markdoc has 1 advisory. Fixed in 2.1.2.

npm

Versions

Red: affected by at least one advisory. White: safe.

2.x
safe 2.1.2
AffectedSafe

Details

Safe
2.1.2
Advisories
1 in 120 days

Used by

Stacks that pull this package.

Not part of a tracked stack.

Alerts(1)

XSS via unescaped code for unsupported languages in @astrojs/prism

@astrojs/prism · 28 Oct

Medium
Exploitable only if · read by Claude, the source remains the reference
  • Project uses @astrojs/prism before 4.1.2 or @astrojs/markdoc before 2.1.2.
  • Code is highlighted with Prism via the prism() Markdoc extension or the <Prism> component.
  • Code blocks use a language label that Prism does not support (e.g. vue, svelte, mdx, console, text).
  • Code content comes from authors or input that cannot otherwise add HTML, such as Markdoc CMS editors, outside contributors, or untrusted input passed to the component's code prop.
Affected
@astrojs/prism <=4.1.1 · @astrojs/markdoc >=0.3.0 <=2.1.1
Fixed in
4.1.2 · 2.1.2
ID
GHSA-ff38-p3qj-4pmf
Open the alert