Threats affecting pkg:github/umputun/remark42

Remark42 versions 1.6.0 through 1.15.0 contain a Cross-Site Scripting (XSS) vulnerability due to inconsistent content-type validation in its image proxy. An attacker can host a malicious URL that advertises an image content-type but serves HTML/JavaScript, causing the proxy to serve attacker-controlled scripts under Remark42's origin. Exploitation requires no user account and can be triggered by delivering the malicious proxy link to victims. This vulnerability is fixed in version 1.16.0.