Security readout for executives and security teams
Plain-English summary
remark-html was documented as safe by default, but affected versions passed user-supplied HTML through when converting Markdown to HTML. If an application renders untrusted Markdown, an attacker could cause stored or reflected cross-site scripting in that application.
Executive priority
Prioritize remediation where Markdown input comes from customers, public users, or semi-trusted contributors. The business risk is account compromise or data exposure through browser-based attacks, especially in admin or support workflows that view submitted content.
Technical view
CVE-2021-39199 affects remarkjs remark-html versions before 13.0.2 and 14.0.0 before 14.0.1. The unsafe default allowed arbitrary HTML through without sanitization, creating CWE-79 XSS risk. Fixed versions make remark-html safe by default; older deployments can opt into sanitization.
Likely exposure
Exposure is most likely in Node.js applications that use remark-html to render Markdown from users, customers, contributors, CMS content, comments, tickets, or documentation. Applications rendering only trusted, controlled Markdown have lower practical exposure, but should still update because the default behavior contradicted documentation.
Exploitation context
The source bundle does not identify active exploitation, and this CVE is not listed as KEV. Practical exploitation depends on an application accepting untrusted Markdown and displaying the generated HTML to other users or administrators.
Researcher notes
The key issue is unsafe default behavior versus documentation, not a parser memory bug. Validate the actual rendering pipeline, because risk requires untrusted Markdown reaching remark-html output and then a browser context. Evidence supports fixed versions and the sanitize option, but not active exploitation.
Mitigation direction
- Upgrade remark-html to 13.0.2, 14.0.1, or later supported versions.
- If upgrade is not possible, enable sanitize: true on older affected versions.
- Treat all user-supplied Markdown as untrusted input before rendering.
- Review downstream HTML rendering paths for missing sanitization controls.
- Monitor vendor advisories and npm dependency alerts for remark-html.
Validation and detection
- Review package manifests and lockfiles for affected remark-html versions.
- Identify application paths that render Markdown from external or low-trust users.
- Confirm sanitization is enabled when affected versions remain deployed.
- Verify generated HTML does not preserve unsafe user-supplied HTML.
- Add regression tests covering untrusted Markdown rendering behavior.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-79: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2021-39199 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 10 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N3.95.8Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
10CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/remarkjs/remark-html/security/advisories/GHSA-9q5w-79cv-947mCVE reference · x_refsource_CONFIRM
- https://github.com/remarkjs/remark-html/commit/b75c9dde582ad87ba498e369c033dc8a350478c1CVE reference · x_refsource_MISC
- https://github.com/remarkjs/remark-html/releases/tag/14.0.1CVE reference · x_refsource_MISC
- https://www.npmjs.com/package/remark-htmlCVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.