Lute Stored Cross-Site Scripting Vulnerability

A stored cross-site scripting vulnerability has been identified in Lute, a structured Markdown engine for Go and JavaScript, specifically in versions through 1.7.6. This vulnerability allows an attacker to inject malicious JavaScript into Markdown content. When the injected content is viewed by another user, the script executes within their session context. The issue arises from inadequate sanitization of certain HTML attributes or event handlers during the Markdown rendering process.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user viewing the content.

Reproduction

To reproduce this vulnerability, create a note and inject a Markdown link that includes a JavaScript URI, such as `javascript:alert('XSS')`. Once the note is saved, the JavaScript will execute when the link is clicked.

Remediation

Users are advised to update to Lute version 1.7.7 or later, where this vulnerability has been patched.