Cross site scripting [self xss] on simplemde-markdown-editor

[raminfp]

Hi,

there is vulnerability XSS on simplemde editor ,

steps :

1 - Go to https://simplemde.com/
2 - copy this '><img src=x onerror=alert(1);> or <img src=x onerror=alertHello!> or <b onclick=alert(1)>click me! and etc
3 - paste on simplemde-markdown-editor
4 - click to preview
5 - you see execute javascript code,

Thanks,
Ramin

[TangentFoxy]

Correct me if I'm wrong, but this is due to Markdown allowing HTML to be used within it, and the problem is just that their demo doesn't disable that. It's not an inherent error/danger in SimpleMDE itself?

[WesCossick]

This is due to Markdown allowing HTML to be used alongside the Markdown syntax. SimpleMDE makes no effort to filter this client side. Your own application code should worry about handling these types of attacks.

[davidcalhoun]

I would be super nice to add this as a recommendation in the docs for previewRender.