CVE-2018-1000874

CVE-2018-1000874 describes a Cross-Site Scripting (XSS) vulnerability in cebe markdown parser versions 1.2.0 and earlier. This flaw allows an attacker to execute malicious scripts by crafting a specific payload within a three-backtick-wrapped code block, potentially leading to the loss of user data or sensitive information. The vulnerability has a CVSSv3 score of 6.1 (Medium), indicating a network-based attack with low complexity requiring user interaction, resulting in low impact to confidentiality and integrity. While the vendor has argued this is not a parser's responsibility to sanitize, there is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.