What’s Vulnerable › Vulnerabilities
CVE-2019-9844
- Severity: medium (CVSS 6.1 v3.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 1.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2019-04-09 · updated 2026-06-17
- Weakness: CWE-79
Description
simple-markdown.js in Khan Academy simple-markdown before 0.4.4 allows XSS via a data: or vbscript: URI.
Affected products
- Fedoraproject Fedora: 30
- simple-markdown: before 0.4.4 — fixed in 0.4.4
How to fix
Upgrade to a fixed version: simple-markdown 0.4.4. Check the vendor advisory for mitigations.
References
- https://github.com/Khan/simple-markdown/pull/63
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JFLP3KJVSV5VWMNEBRXLGRVYFXOV5KOG/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KZG2I7VH7WLSEUQ77KYP5CRAVFT2RK2U/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O5EFW655O3BXZYAPB65XEREXB2DSNSOT/
- https://www.npmjs.com/package/simple-markdown/v/0.4.4
- https://github.com/Khan/simple-markdown/pull/63
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JFLP3KJVSV5VWMNEBRXLGRVYFXOV5KOG/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KZG2I7VH7WLSEUQ77KYP5CRAVFT2RK2U/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O5EFW655O3BXZYAPB65XEREXB2DSNSOT/
- https://www.npmjs.com/package/simple-markdown/v/0.4.4
Get alerted when CVE-2019-9844 or the next vulnerability affects your stack