Versions 1.4.0 and earlier of remarkable are affected by a cross-site scripting vulnerability.
Full advisory text at GitHub advisory or NVD.
npm package report
Is remarkable safe?
remarkable (npm) has 4 known vulnerabilities, the worst rated HIGH. Upgrade to 1.7.2 or later to clear all of them. No malicious-package signal is recorded.
// reach
0 direct dependencies
none carry a known advisory
Create a free accountfor every dependency path, dependent and what to upgrade
// ai model usage
Tracked for PyPI packages. HuggingFace models declare Python dependencies, so npm packages are not covered.
cvss
7.5
high
severity band, no base score published
epss
0.94%
medium
chance of exploitation in 30 days, 61st percentile of all CVEs
xyz score
4.2
medium
CyberXYZ composite out of 10
fig. 01 — GHSA-f9vc-q3hh-qhfv, the advisory selected below
// 4 advisories
Is remarkable safe to install?
CyberXYZ does not call a package safe in absolute terms. It records 4 known vulnerabilities for remarkable (npm), the worst rated HIGH, and no malicious-package signal. Whether it is acceptable depends on the version you run.
Does remarkable have known vulnerabilities?
Yes. CyberXYZ records 4 known vulnerabilities for remarkable (npm), the worst rated HIGH. They are GHSA-f9vc-q3hh-qhfv, GHSA-q22g-8fr4-qpj4, GHSA-mrmf-qwxg-7c3h, GHSA-36m4-6v6m-4vpr.
Which version of remarkable should I use?
1.7.2 or later clears every advisory recorded for remarkable (npm). Check the release you pick before installing it.
How do I check remarkable before installing?
Search remarkable in CyberXYZ Check at https://cyberxyz.io/check?q=remarkable. The xyz Scanner checks a project's dependencies, and CyberXYZ Proxy checks each package as it is installed.
Checked 2026-11-14 at 11:03 UTC. The most recent advisory here was published 2020-08-31. Updated continuously from NVD, GHSA, OSV and CNA feeds.