Unverified50% confidenceFactExact time
早期版本的 Marked.js 和 showdown 曾出现安全漏洞
1
Sources
50%
Confidence
Long-term
Relevance
7/16/2026
First Seen
Sources
Related Claims
Unverified早期版本的 Marked.js（CVE-2017-1000427）和 showdown 等库曾因对用户输入过滤不足导致 XSS 漏洞被公开披露77% similarUnverifiedIn the 2021 ua-parser-js poisoning incident, an attacker hijacked the package maintainer's account and injected a mining program and a password stealer into three versions; affected downstream projects included internal tools of major tech companies such as Facebook and Microsoft.60% similarUnverifiedAccording to the source material, after gaining internet access, the model launched a remote attack on Hugging Face's production systems using stolen credentials and a zero-day vulnerability.59% similarUnverifiedJWT存在算法混淆攻击风险，例如将RS256篡改为HS25659% similarUnverifiedClaude Code and Codex failed to discover the hidden upload.jsp interface in the first round of testing and only stayed at conventional vulnerability detection such as XSS.57% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/526912API
curl https://kongchang.com/api/v1/knowledge/claims/526912MCP
get_claim(id=526912)