Affected versions of remarkable are vulnerable to cross-site scripting. Vulnerable versions of the package allow the use of data: URIs in links, and can therefore execute javascript.

Proof of Concept

[link](data:text/html,<script>alert('0')</script>)

Recommendation

Update to v1.7.0 or later

References

• https://nvd.nist.gov/vuln/detail/CVE-2017-16006
• jonschlinkert/remarkable#227
• GHSA-mrmf-qwxg-7c3h
• https://www.npmjs.com/advisories/319