Cross-site Scripting (XSS)

Vulnerability

Overview The joyqi/hyper-down package (also known as HyperDown) is a PHP Markdown parser vulnerable to Cross-site Scripting (XSS) because it fails to properly filter the href attribute in markdown links [1]. This allows attackers to inject javascript: URIs that execute arbitrary JavaScript when a user clicks the crafted link.

Exploitation

An attacker can supply markdown text such as `!. When parsed and rendered as HTML, the href` contains a javascript: URI that is not blocked. If a victim clicks the link, the script executes in their browser context [1]. No authentication is required; the attack vector is user interaction.

Impact

Successful exploitation leads to arbitrary JavaScript execution, potentially enabling session hijacking, credential theft, or defacement [2]. The vulnerability affects all versions of the package as no fix has been released.

Mitigation

As of the latest advisory, there is no patched version available [1]. Users should avoid using this library or implement custom filtering to sanitize href attributes. The source code is available on GitHub [3].