Medium severity5.4NVD Advisory· Published Jul 24, 2017· Updated May 13, 2026
CVE-2017-11594
CVE-2017-11594
Description
Cross-site scripting (XSS) vulnerability in the Markdown parser in Loomio before 1.8.0 allows remote attackers to inject arbitrary web script or HTML via non-sanitized Markdown content in a new thread or a thread comment.
Affected products
8cpe:2.3:a:loomio:loomio:1.0.0:*:*:*:*:*:*:*+ 7 more
- cpe:2.3:a:loomio:loomio:1.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:loomio:loomio:1.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:loomio:loomio:1.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:loomio:loomio:1.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:loomio:loomio:1.4.0:*:*:*:*:*:*:*
- cpe:2.3:a:loomio:loomio:1.5.0:*:*:*:*:*:*:*
- cpe:2.3:a:loomio:loomio:1.6.0:*:*:*:*:*:*:*
- cpe:2.3:a:loomio:loomio:1.7.0:*:*:*:*:*:*:*
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
3- github.com/loomio/loomio/commit/63973f71e337ead8ca7b7ae2a043b837032dc3fenvdPatchThird Party Advisory
- github.com/loomio/loomio/issues/4220nvdExploitThird Party Advisory
- github.com/loomio/loomio/releases/tag/1.8.0nvdThird Party Advisory
News mentions
0No linked articles in our index yet.