Affected versions of `remarkable` are vulnerable to cross-site scripting. Vulnerable versions of the package allow the use of `data:` URIs in links, and can therefore execute javascript.

## Proof of Concept

```markdown
[link](data:text/html,<script>alert('0')</script>)
```

## Recommendation

Update to v1.7.0 or later

Affected Packages

npm remarkable

Affected versions: 0 (fixed in 1.7.0)

Related CVEs

CVE-2017-16006

Key Information

GHSA ID

GHSA-mrmf-qwxg-7c3h

Published

November 9, 2018 5:48 PM

Last Modified

September 8, 2023 7:51 PM

CVSS Score

7.5 /10

Primary Ecosystem

npm

Primary Package

remarkable

GitHub Reviewed

✓ Yes

Dataset

Last updated: July 3, 2025 6:26 AM

Data from GitHub Advisory Database. This information is provided for research and educational purposes.