CVE-2017-16006

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Remarkable is a markdown parser. In versions 1.6.2 and lower, remarkable allows the use of `data:` URIs in links and can therefore execute javascript.

Metrics

CVSS 3.0 6.1/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
HackerOne	remarkable node module	<=1.6.2

References

https://github.com/jonschlinkert/remarkable/issues/227Exploit, Issue Tracking, Patch, Third Party Advisory
https://nodesecurity.io/advisories/319Exploit, Third Party Advisory
https://github.com/jonschlinkert/remarkable/issues/227Exploit, Issue Tracking, Patch, Third Party Advisory
https://nodesecurity.io/advisories/319Exploit, Third Party Advisory

Timeline

Published: Jun 4, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-160075.9node-jose is a JavaScript implementation of the JSON Object Signing and Encryption (JOSE) for current web browsers and node.js-based servers CVE-2017-160086.1i18next is a language translation framework. Because of how the interpolation is implemented, making replacements from the dictionary one at CVE-2017-160096.1ag-grid is an advanced data grid that is library agnostic. ag-grid is vulnerable to Cross-site Scripting (XSS) via Angular Expressions, if A CVE-2017-16019.8IBM Security Guardium 10.0, 10.0.1, and 10.1 through 10.1.4 Database Activity Monitor does not require that users should have strong passwor CVE-2017-160106.1i18next is a language translation framework. When using the .init method, passing interpolation options without passing an escapeValue will CVE-2017-160137.5hapi is a web and services application framework. When hapi >= 15.0.0 <= 16.1.0 encounters a malformed `accept-encoding` header an uncaught CVE-2017-160147.5Http-proxy is a proxying library. Because of the way errors are handled in versions before 0.7.0, an attacker that forces an error can crash CVE-2017-160156.1Forms is a library for easily creating HTML forms. Versions before 1.3.0 did not have proper html escaping. This means that if the applicati CVE-2017-160166.1Sanitize-html is a library for scrubbing html input of malicious values. Versions 1.11.1 and below are vulnerable to cross site scripting (X CVE-2017-160176.1sanitize-html is a library for scrubbing html input for malicious values Versions 1.2.2 and below have a cross site scripting vulnerability.CVE-2017-160186.1Restify is a framework for building REST APIs. Restify >=2.0.0 <=4.0.4 using URL encoded script tags in a non-existent URL, an attacker can CVE-2017-160196.1GitBook is a command line tool (and Node.js library) for building beautiful books using GitHub/Git and Markdown (or AsciiDoc). Stored Cross-