-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| io.jenkins.plugins:markdown-formatter | maven | <= 0.1.0 | 0.2.0 |
JavaJavaMiggo AIRoot Cause AnalysisThe vulnerability stemmed from improper URL sanitization in markdown link rendering. The pre-patch code used Flexmark library's HtmlRenderer with escapeHtml(true) but lacked URL sanitization features. The critical fix in the commit switched to CommonMark's HtmlRenderer with both escapeHtml(true) and sanitizeUrls(true), explicitly addressing URL schemes. The test case changes demonstrate that previously dangerous links like click me were not properly neutralized, while post-patch they get sanitized with 'nofollow' and empty hrefs. The translate method is directly responsible for parsing and rendering user-controlled markdown content, making it the vulnerable entry point.
Ongoing coverage of React2Shell