You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Marked is a markdown parser and compiler. Prior to version 4.0.10, the regular expression inline.reflinkSearch may cause catastrophic backtracking against some strings and lead to a denial of service (DoS). Anyone who runs untrusted markdown through a vulnerable version of marked and does not use a worker with a time limit may be affected. This issue is patched in version 4.0.10. As a workaround, avoid running untrusted markdown through marked or run marked on a worker thread and set a reasonable time limit to prevent draining resources.
CVE-2022-21681 - High Severity Vulnerability
Vulnerable Libraries - marked-1.2.9.tgz, marked-2.1.3.tgz
marked-1.2.9.tgz
A markdown parser built for speed
Library home page: https://registry.npmjs.org/marked/-/marked-1.2.9.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/marked/package.json
Dependency Hierarchy:
marked-2.1.3.tgz
A markdown parser built for speed
Library home page: https://registry.npmjs.org/marked/-/marked-2.1.3.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/jsdoc/node_modules/marked/package.json
Dependency Hierarchy:
Found in HEAD commit: b62dc5904e187f6d95d8e4154717e45bba8207c6
Found in base branch: master
Vulnerability Details
Marked is a markdown parser and compiler. Prior to version 4.0.10, the regular expression
inline.reflinkSearch
may cause catastrophic backtracking against some strings and lead to a denial of service (DoS). Anyone who runs untrusted markdown through a vulnerable version of marked and does not use a worker with a time limit may be affected. This issue is patched in version 4.0.10. As a workaround, avoid running untrusted markdown through marked or run marked on a worker thread and set a reasonable time limit to prevent draining resources.Publish Date: 2022-01-14
URL: CVE-2022-21681
CVSS 3 Score Details (7.5)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: GHSA-5v2h-r2cx-5xgj
Release Date: 2022-01-14
Fix Resolution (marked): 4.0.10
Direct dependency fix Resolution (jsdoc-to-markdown): 7.0.0
Fix Resolution (marked): 4.0.10
Direct dependency fix Resolution (jsdoc-to-markdown): 7.0.0
Step up your Open Source Security Game with Mend here
The text was updated successfully, but these errors were encountered: