CVE-2025-7969

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in markdown-it allows Cross-Site Scripting (XSS). This vulnerability is associated with program files lib/renderer.mjs.

This issue affects markdown-it: 14.1.0.
Cross-site Scripting
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
UNKNOWN
---
Fluid AttacksCNA
---
---
CISA-ADPADP
---
---
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 13%
Debian logo
Debian Releases
Debian Product
Codename
node-markdown-it
bullseye
vulnerable
forky
vulnerable
sid
vulnerable
bookworm
vulnerable
trixie
vulnerable
Common Weakness Enumeration
References
https://fluidattacks.com/advisories/fito
https://github.com/markdown-it/markdown-it
https://fluidattacks.com/advisories/fito