markdown-it before 4.1.0 does not block data: URLs.
CVE Status: Modified
No CVSS data available
Exploit-db Github