CVE-2019-9844

Vulnerability

A cross-site scripting (XSS) vulnerability exists in Khan Academy's simple-markdown library prior to version 0.4.4. The library fails to properly sanitize URIs in markdown links, allowing dangerous schemes such as data: and vbscript: to be used. This affects all versions before 0.4.4 [1][3].

Exploitation

An attacker can craft a markdown link containing a data: or vbscript: URI. No authentication or special privileges are required; the exploit is triggered when a user clicks on the malicious link [2]. The attacker does not need any network position beyond being able to serve or inject the markdown content.

Impact

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the victim's browser session. This can lead to information disclosure, session hijacking, or other unauthorized actions, depending on the application's use of the library [3].

Mitigation

Upgrade to simple-markdown version 0.4.4 or later, which fixes the issue by blocking dangerous URI schemes. The fix was implemented in pull request #63 [2]. No workarounds have been published for earlier versions [3].