Unverified50% confidenceFactExact time
早期版本的 Marked.js（CVE-2017-1000427）和 showdown 等库曾因对用户输入过滤不足导致 XSS 漏洞被公开披露
1
Sources
50%
Confidence
Long-term
Relevance
7/16/2026
First Seen
Sources
Related Claims
Unverified早期版本的 Marked.js 和 showdown 曾出现安全漏洞77% similarUnverifiedXSS (Cross-Site Scripting) is one of the most common vulnerabilities in web security, and attackers can steal cookies, session tokens, or other sensitive information by injecting malicious scripts.72% similarUnverifiedClaude Code and Codex failed to discover the hidden upload.jsp interface in the first round of testing and only stayed at conventional vulnerability detection such as XSS.66% similarUnverifiedXZ Utils 后门的恶意代码隐藏在测试用二进制文件中，通过修改后的 m4 构建脚本在编译时提取注入，并通过劫持 RSA_public_decrypt 函数检查特定公钥62% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/527050API
curl https://kongchang.com/api/v1/knowledge/claims/527050MCP
get_claim(id=527050)