CVE-2024-21535: Quantizor Markdown-to-jsx XSS Vulnerability

CVE-2024-21535 Overview

CVE-2024-21535 is a Cross-Site Scripting (XSS) vulnerability affecting the markdown-to-jsx npm package, a widely used React library for converting Markdown to JSX. Versions before 7.4.0 fail to sanitize the src property, allowing attackers to inject malicious iframe elements through crafted Markdown input. When rendered, the injected content executes arbitrary JavaScript in the victim's browser context. The flaw is classified under CWE-79: Improper Neutralization of Input During Web Page Generation. Exploitation requires user interaction, such as viewing a page that renders attacker-controlled Markdown.

Critical Impact
Attackers can execute arbitrary JavaScript in a victim's browser by embedding a malicious iframe in Markdown content, leading to session theft, credential harvesting, or unauthorized actions on behalf of the user.

Affected Products

quantizor/markdown-to-jsx versions prior to 7.4.0
Applications rendering untrusted Markdown through the vulnerable library
Downstream React applications and component libraries bundling affected versions

Discovery Timeline

2024-10-15 - CVE-2024-21535 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-21535

Vulnerability Analysis

The vulnerability resides in the attribute-processing logic of markdown-to-jsx. The library sanitized URL values for the href attribute but omitted equivalent handling for the src attribute. As a result, attacker-supplied src values passed through Markdown were rendered directly into the DOM without URL scheme validation. An attacker can craft Markdown that includes an iframe element with a javascript: URI in the src attribute. When the resulting React tree is rendered, the browser evaluates the malicious script in the origin of the hosting application. The impact scope extends across the security boundary of the page, exposing session cookies, tokens accessible via document, and any authenticated APIs. Because the package is embedded in many client-side rendering pipelines, exploitation surface includes documentation portals, CMS previews, comment systems, and chat interfaces.

Root Cause

The root cause is missing input sanitization on the src property in the attribute handler. The sanitizeUrl routine was invoked for href values but not for src, leaving image and iframe sources unchecked for dangerous URI schemes such as javascript:.

Attack Vector

Exploitation is network-based and requires user interaction. An attacker submits Markdown containing a malicious iframe element to any application feature that renders content via markdown-to-jsx. When a victim loads the rendered page, the injected script executes in the application origin.

text

       return styles
     }, {})
-  } else if (key === 'href') {
+  } else if (key === 'href' || key === 'src') {
     return sanitizeUrl(value)
   } else if (value.match(INTERPOLATION_R)) {
     // return as a string and let the consumer decide what to do with it

Source: GitHub Commit 8eb74da — the patch extends the existing sanitizeUrl call to cover the src attribute alongside href.

Detection Methods for CVE-2024-21535

Indicators of Compromise

Markdown submissions containing iframe tags or src attributes referencing javascript: URIs
Rendered pages emitting iframe elements with non-http(s) scheme sources
Unexpected outbound requests from browsers to attacker-controlled origins after rendering user-generated Markdown

Detection Strategies

Perform software composition analysis (SCA) to identify projects depending on markdown-to-jsx versions below 7.4.0
Add browser Content Security Policy (CSP) reporting to capture script-src and frame-src violations that indicate injection attempts
Review web application logs for Markdown payloads containing <iframe, src="javascript:, or encoded variants such as javascript:

Monitoring Recommendations

Continuously monitor package manifests (package.json, package-lock.json, yarn.lock) in CI pipelines for vulnerable versions
Alert on CSP violation reports pointing to inline script execution or unexpected iframe sources
Instrument client-side error and telemetry pipelines to flag anomalous script origins on pages that render user Markdown

How to Mitigate CVE-2024-21535

Immediate Actions Required

Upgrade markdown-to-jsx to version 7.4.0 or later across all applications and shared component libraries
Audit user-generated content stores for previously submitted Markdown that references iframe elements or javascript: URIs
Rebuild and redeploy front-end bundles to ensure patched code is served to end users

Patch Information

The fix is committed in GitHub Commit 8eb74da and shipped in markdown-to-jsx7.4.0. The patch routes the src attribute through the existing sanitizeUrl function, rejecting dangerous URI schemes. See the Snyk Vulnerability Report for advisory details.

Workarounds

Strip or reject iframe elements from user-supplied Markdown before rendering when upgrading is not immediately feasible
Enforce a strict Content Security Policy that blocks inline scripts and restricts frame-src to trusted origins
Post-process rendered output with a hardened HTML sanitizer such as DOMPurify configured to disallow javascript: URIs

bash

# Upgrade to the patched version
npm install markdown-to-jsx@^7.4.0

# Verify the resolved version
npm ls markdown-to-jsx