In remarkable 1.7.1, lib/parser_inline.js mishandles URL filtering, which allows malicious users to trigger XSS via unprintable characters, as demonstrated by a \x0ejavascript: URL.
Vulnerable Product | Search on Vulmon | Subscribe to Product |
---|---|---|
remarkable project remarkable 1.7.1 |