remarkable project vulnerabilities

Products

• remarkable 4

Latest remarkable project CVEs

Newest publication first

1. CVE-2019-12043 Cross-site Scripting in remarkable

   Published 2019-05-13

   Medium·CVSS 6.1 EPSS 0.87%

   In remarkable 1.7.1, lib/parser_inline.js mishandles URL filtering, which allows attackers to trigger XSS via unprintable characters, as demonstrated by a \x0ejavascript: URL.

2. CVE-2019-12041 Regular Expression Denial of Service in remarkable

   Published 2019-05-13

   High·CVSS 7.5 EPSS 1.3%

   lib/common/html_re.js in remarkable 1.7.1 allows Regular Expression Denial of Service (ReDoS) via a CDATA section.

3. CVE-2017-16006 XSS in Data URI in remarkable

   Published 2018-06-04

   Medium·CVSS 6.1 EPSS 0.96%

   Remarkable is a markdown parser. In versions 1.6.2 and lower, remarkable allows the use of data: URIs in links and can therefore execute javascript.

4. CVE-2014-10065 Content Injection in remarkable

   Published 2018-05-31

   Medium·CVSS 6.1 EPSS 0.94%

   Certain input when passed into remarkable before 1.4.1 will bypass the bad protocol check that disallows the javascript: scheme allowing for javascript: url's to be injected into the rendered content.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.