Threats tagged 'ghsa-g3pw-9gjh-mjcc'

FileCodeBox versions 2.2.1 through 2.8.4 have a stored cross-site scripting (XSS) vulnerability in the renderMarkdownPreview function. This flaw occurs because the function returns unsanitized text when the marked parser throws an error. Unauthenticated attackers can exploit this by sharing text containing thousands of nested blockquote markers followed by malicious HTML payloads, which execute scripts that steal the admin token from localStorage.