CVE-2021-39199

remark-html is an open source nodejs library which compiles Markdown to HTML. In affected versions the documentation of remark-html has mentioned that it was safe by default. In practice the default was never safe and had to be opted into. That is, user input was not sanitized. This means arbitrary HTML can be passed through leading to potential XSS attacks. The problem has been patched in 13.0.2 and 14.0.1: `remark-html` is now safe by default, and the implementation matches the documentation. On older affected versions, pass `sanitize: true` if you cannot update.

• CWE-79

• https://github.com/remarkjs/remark-html/commit/b75c9dde582ad87ba498e369c033dc8a350478c1Patch, Third Party Advisory
• https://github.com/remarkjs/remark-html/releases/tag/14.0.1Patch, Release Notes, Third Party Advisory
• https://github.com/remarkjs/remark-html/security/advisories/GHSA-9q5w-79cv-947mPatch, Third Party Advisory
• https://www.npmjs.com/package/remark-htmlProduct, Third Party Advisory
• https://github.com/remarkjs/remark-html/commit/b75c9dde582ad87ba498e369c033dc8a350478c1Patch, Third Party Advisory
• https://github.com/remarkjs/remark-html/releases/tag/14.0.1Patch, Release Notes, Third Party Advisory
• https://github.com/remarkjs/remark-html/security/advisories/GHSA-9q5w-79cv-947mPatch, Third Party Advisory
• https://www.npmjs.com/package/remark-htmlProduct, Third Party Advisory

Published

Sep 7, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-39193Frontier is Substrate's Ethereum compatibility layer. Prior …5.3
• CVE-2021-39194kaml is an open source implementation of the YAML format wit…6.5
• CVE-2021-39195Misskey is an open source, decentralized microblogging platf…6.5
• CVE-2021-39196pcapture is an open source dumpcap web service interface . I…6.5
• CVE-2021-39197better_errors is an open source replacement for the standard…8.8
• CVE-2021-39198OroCRM is an open source Client Relationship Management (CRM…5.4
• CVE-2021-3920grav-plugin-admin is vulnerable to Improper Neutralization o…5.4
• CVE-2021-39200WordPress is a free and open-source content management syste…5.3
• CVE-2021-39201WordPress is a free and open-source content management syste…5.4
• CVE-2021-39202WordPress is a free and open-source content management syste…5.4
• CVE-2021-39203WordPress is a free and open-source content management syste…6.5
• CVE-2021-39204Pomerium is an open source identity-aware access proxy. Envo…7.5