Merge commit from fork

Revert sanitization process preserving HTML comments
marp-team · Dec 24, 2024 · 61a1def · 61a1def
2 parents 44d1655 + ecaddfb
commit 61a1def
Show file tree

Hide file tree

Showing 4 changed files with 424 additions and 300 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -2,6 +2,10 @@
 
 ## [Unreleased]
 
+### Security
+
+- Improper neutralization of HTML sanitization by comments may lead to XSS (by [@Ry0taK](https://github.com/Ry0taK))
+
 ### Changed
 
 - Upgrade Marpit to [v3.1.2](https://github.com/marp-team/marpit/releases/v3.1.2) ([#390](https://github.com/marp-team/marp-core/pull/390))