Medium severity6.1NVD Advisory· Published Jul 24, 2017· Updated Jun 17, 2026

CVE-2017-11593

Description

Cross-site scripting (XSS) vulnerability in the Markdown Preview Plus extension before 0.5.7 for Chrome allows remote attackers to inject arbitrary web script or HTML into some web applications via the upload and display of crafted text, markdown, or rst files that are designed to be viewed in the browser as plain text, but that will be converted to HTML without proper sanitization.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Ooso/Markdown Preview Plus
cpe:2.3:a:ooso:markdown_preview_plus:*:*:*:*:*:chrome:*:*
Range: <=0.4.5
Google/Markdown Preview Plusllm-create
Range: <0.5.7

Patches

Vulnerability mechanics

References

github.com/volca/markdown-preview/commit/1181f044a5457d5e1ac35804ecd84e05977f1920nvdPatchVendor Advisory
github.com/volca/markdown-preview/issues/60nvdExploitIssue TrackingThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.397
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000