CVE-2021-47839

Published: Jan 16, 2026Modified: Jul 15, 2026Deferred

5.1

Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Show more

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: disclosure@vulncheck.com (Secondary)

Description

Marky 0.0.1 contains a persistent cross-site scripting vulnerability that allows attackers to inject malicious scripts into markdown files. Attackers can upload crafted markdown files with embedded JavaScript payloads that execute when the file is opened, potentially enabling remote code execution.

Related CWEs

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (8)

https://github.com/vesparny/marky

Source: disclosure@vulncheck.com

https://imgur.com/a/qclfrUx

Source: disclosure@vulncheck.com

https://www.exploit-db.com/exploits/49831

Source: disclosure@vulncheck.com

https://www.vulncheck.com/advisories/marky-persistent-cross-site-scripting

Source: disclosure@vulncheck.com

https://access.redhat.com/security/cve/CVE-2021-47839

Source: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c

https://bugzilla.redhat.com/show_bug.cgi?id=2430451

Source: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c

https://security.access.redhat.com/data/csaf/v2/vex/2021/cve-2021-47839.json

Source: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c

https://www.vulncheck.com/advisories/marky-persistent-cross-site-scripting

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.