Advisories for Npm/Zmarkdown package

Impact A major blind SSRF has been found in remark-images-download, which allowed for requests to be made to neighboring servers on local IP ranges. The issue came from a loose filtering of URLs inside the module. Imagine a server running on a private network 192.168.1.0/24. A private service serving images is running on 192.168.1.2, and is not expected to be accessed by users. A machine is running remark-images-download on the …

Impact A minor Local File Inclusion vulnerability has been found in zmarkdown, which allowed for images with a known path on the host machine to be included inside a LaTeX document. To prevent it, a new option has been created that allow to replace invalid paths with a default image instead of linking the image on the host directly. zmarkdown has been updated to make this setting the default. Every …