Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
13 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
A critical Denial of Service (DoS) vulnerability exists in marked@18.0.0. By providing a specific 3-byte input sequence a tab, a vertical tab, and a newline (\x09\x0b\n)—an unauthenticated attacker can trigger an infinite recursion loop during parsing. This leads to unbounded memory allocation, causing the host Node.js application to crash via Memory Exhaustion (OOM). Details The vulnerability originates in how marked's block tokenizer handles unexpected whitespace characters. 1. Tab Character (\x09) Consumption: The space() tokenizer matches standard whitespace using the regex /^(?: \t)+/. When parsing the malicious payload (\x09\x0b\n), this rule successfully consumes the initial tab character (\x09). 2. Vertical Tab (\x0b) Bypass: The remaining input is now \x0b\n. The newline block rule explicitly looks for spaces or standard tabs ([ \t]) followed by a newline. Because the vertical tab is a legacy ASCII character not accounted for in this rule, it fails to…
Recommended action: Upgrade to 18.0.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Marked prior to version 0.3.17 is vulnerable to a Regular Expression Denial of Service (ReDoS) attack due to catastrophic backtracking in several regular expressions used for parsing HTML tags and markdown links. An attacker can exploit this vulnerability by providing specially crafted markdown input, such as deeply nested or repetitively structured brackets or tag attributes, which cause the parser to hang and lead to a Denial of Service.
Recommended action: Upgrade to 0.3.17 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact What kind of vulnerability is it? Denial of service. The regular expression inline.reflinkSearch may cause catastrophic backtracking against some strings. PoC is the following. Who is impacted? Anyone who runs untrusted markdown through marked and does not use a worker with a time limit. Patches Has the problem been patched? Yes What versions should users upgrade to? 4.0.10 Workarounds Is there a way for users to fix or remediate the vulnerability without upgrading? Do not run untrusted markdown through marked or run marked on a worker thread and set a reasonable time limit to prevent draining resources. References Are there any links users can visit to find out more? - https://marked.js.org/usingadvanced#workers - https://owasp.org/www-community/attacks/RegularexpressionDenialofService-ReDoS For more information If you have any questions or comments about this advisory: Open an issue in marked
Recommended action: Upgrade to 4.0.10 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact What kind of vulnerability is it? Denial of service. The regular expression block.def may cause catastrophic backtracking against some strings. PoC is the following. Who is impacted? Anyone who runs untrusted markdown through marked and does not use a worker with a time limit. Patches Has the problem been patched? Yes What versions should users upgrade to? 4.0.10 Workarounds Is there a way for users to fix or remediate the vulnerability without upgrading? Do not run untrusted markdown through marked or run marked on a worker thread and set a reasonable time limit to prevent draining resources. References Are there any links users can visit to find out more? - https://marked.js.org/usingadvanced#workers - https://owasp.org/www-community/attacks/RegularexpressionDenialofService-ReDoS For more information If you have any questions or comments about this advisory: Open an issue in marked
Recommended action: Upgrade to 4.0.10 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact What kind of vulnerability is it? Who is impacted? Regular expression Denial of Service A Denial of Service attack can affect anyone who runs user generated code through marked. Patches Has the problem been patched? What versions should users upgrade to? patched in v2.0.0 Workarounds Is there a way for users to fix or remediate the vulnerability without upgrading? None. References Are there any links users can visit to find out more? https://github.com/markedjs/marked/issues/1927 https://owasp.org/www-community/attacks/RegularexpressionDenialofService-ReDoS For more information If you have any questions or comments about this advisory: Open an issue in marked
Recommended action: Upgrade to 2.0.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Affected versions of marked are vulnerable to Regular Expression Denial of Service (ReDoS). The label subrule may significantly degrade parsing performance of malformed input. Recommendation Upgrade to version 0.7.0 or later.
Recommended action: Upgrade to 0.7.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Versions 0.3.0 and earlier of marked are affected by two cross-site scripting vulnerabilities, even when sanitize: true is set. The attack vectors for this vulnerability are GFM Codeblocks and JavaScript URLs. Recommendation Upgrade to version 0.3.1 or later.
Recommended action: Upgrade to 0.3.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Versions of marked from 0.3.14 until 0.6.2 are vulnerable to Regular Expression Denial of Service. Email addresses may be evaluated in quadratic time, allowing attackers to potentially crash the node process due to resource exhaustion. Recommendation Upgrade to version 0.6.2 or later.
Recommended action: Upgrade to 0.6.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Affected versions of marked are susceptible to a cross-site scripting vulnerability in link components when sanitize:true is configured. Proof of Concept This flaw exists because link URIs containing HTML entities get processed in an abnormal manner. Any HTML Entities get parsed on a best-effort basis and included in the resulting link, while if that parsing fails that character is omitted. For example: A link URI such as Renders a valid link that when clicked will execute alert(1). Recommendation Update to version 0.3.6 or later.
Recommended action: Upgrade to 0.3.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Affected versions of marked are vulnerable to a regular expression denial of service. The amplification in this vulnerability is significant, with 1,000 characters resulting in the event loop being blocked for around 6 seconds. Recommendation Update to version 0.3.9 or later.
Recommended action: Upgrade to 0.3.9 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
marked version 0.3.6 and earlier is vulnerable to an XSS attack in the data: URI parser.
Recommended action: Upgrade to 0.3.7 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Versions 0.3.3 and earlier of marked are affected by a regular expression denial of service ( ReDoS ) vulnerability when passed inputs that reach the em inline rule. Recommendation Update to version 0.3.4 or later.
Recommended action: Upgrade to 0.3.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Versions 0.3.2 and earlier of marked are affected by a cross-site scripting vulnerability even when sanitize:true is set. Proof of Concept ( IE10 Compatibility Mode Only ) xss link will get a link <a href="vbscript:alert(1)"xss link</a Recommendation Update to version 0.3.3 or later.
Recommended action: Upgrade to 0.3.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.