Vulnerability-Lookup

GHSA-85Q9-7467-R53Q

Vulnerability from github – Published: 2022-06-17 21:51 – Updated: 2026-04-24 19:49

Summary

XSS Vulnerability in Markdown Editor

Details

Impact

InvenTree uses EasyMDE for displaying markdown text in various places (e.g. for the various "notes" fields associated with various models).

By default, EasyMDE does not sanitize input data, and it is possible for malicious code to be injected into the markdown editor, and executed in the users browser.

Note: This malicious data must be first uploaded to the database by an authorized user, so the risk here is limited to trusted users

Solution

The solution here is two-fold:

Enable data sanitization for the EasyMDE renderer - #3205
Enforce cleaning of all data uploaded to the database via the API - #3204 (This will be ready for the 0.8.0 release)

Patches

The issue is addressed in the 0.8.0 release
This fix was back-ported to the 0.7.x branch, applied to the 0.7.3 release

Workarounds

There is no workaround for this issue without upgrading InvenTree to the specified version.

References

https://huntr.dev/bounties/ab296cf5-7a3e-4f49-8f63-5b35fc707f03/

For more information

If you have any questions or comments about this advisory:

Open an issue in github
Email us at security@inventree.org

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "inventree"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.7.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-06-17T21:51:45Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Impact\n\nInvenTree uses [EasyMDE](https://github.com/Ionaru/easy-markdown-editor) for displaying markdown text in various places (e.g. for the various \"notes\" fields associated with various models).\n\nBy default, EasyMDE does not sanitize input data, and it is possible for malicious code to be injected into the markdown editor, and executed in the users browser.\n\n*Note: This malicious data must be first uploaded to the database by an authorized user, so the risk here is limited to trusted users*\n\n### Solution\n\nThe solution here is two-fold:\n\n- Enable data sanitization for the EasyMDE renderer - [#3205](https://github.com/inventree/InvenTree/pull/3205)\n- Enforce cleaning of all data uploaded to the database via the API - [#3204](https://github.com/inventree/InvenTree/pull/3204) *(This will be ready for the 0.8.0 release)*\n\n### Patches\n\n- The issue is addressed in the 0.8.0 release\n- This fix was back-ported to the 0.7.x branch, applied to the 0.7.3 release\n\n### Workarounds\n\nThere is no workaround for this issue without upgrading InvenTree to the specified version.\n\n### References\n\n- https://huntr.dev/bounties/ab296cf5-7a3e-4f49-8f63-5b35fc707f03/\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n\n* Open an issue in [github](http://github.com/inventree/inventree)\n* Email us at [security@inventree.org](mailto:security@inventree.org)",
  "id": "GHSA-85q9-7467-r53q",
  "modified": "2026-04-24T19:49:10Z",
  "published": "2022-06-17T21:51:45Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/inventree/InvenTree/security/advisories/GHSA-85q9-7467-r53q"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [],
  "summary": "XSS Vulnerability in Markdown Editor"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted