Github Dependency Security Alert

[will-amaral]

There are two security alerts regarding the 1.7.1 npm version.

More specifically:

high severity
Vulnerable versions: <= 1.7.1
Patched version: No fix
lib/common/html_re.js in remarkable 1.7.1 allows Regular Expression Denial of Service (ReDoS) via a CDATA section.

CVE-2019-12043 More information
moderate severity
Vulnerable versions: <= 1.7.1
Patched version: No fix
In remarkable 1.7.1, lib/parser_inline.js mishandles URL filtering, which allows attackers to trigger XSS via unprintable characters, as demonstrated by a \x0ejavascript: URL.

Are there any plans for a new version to patch this issues.

[eahefnawy]

Facing the same issue

[claudiopro]

This is a duplicate of #332

[shockey]

Closing as a duplicate of #331 + #332.