You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Marked is a markdown parser and compiler. Prior to version 4.0.10, the regular expression block.def may cause catastrophic backtracking against some strings and lead to a regular expression denial of service (ReDoS). Anyone who runs untrusted markdown through a vulnerable version of marked and does not use a worker with a time limit may be affected. This issue is patched in version 4.0.10. As a workaround, avoid running untrusted markdown through marked or run marked on a worker thread and set a reasonable time limit to prevent draining resources.
CVE-2022-21680 - High Severity Vulnerability
marked-1.2.9.tgz
A markdown parser built for speed
Library home page: https://registry.npmjs.org/marked/-/marked-1.2.9.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/marked/package.json
Dependency Hierarchy:
marked-2.1.3.tgz
A markdown parser built for speed
Library home page: https://registry.npmjs.org/marked/-/marked-2.1.3.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/jsdoc/node_modules/marked/package.json
Dependency Hierarchy:
Found in HEAD commit: b62dc5904e187f6d95d8e4154717e45bba8207c6
Found in base branch: master
Marked is a markdown parser and compiler. Prior to version 4.0.10, the regular expression
block.def
may cause catastrophic backtracking against some strings and lead to a regular expression denial of service (ReDoS). Anyone who runs untrusted markdown through a vulnerable version of marked and does not use a worker with a time limit may be affected. This issue is patched in version 4.0.10. As a workaround, avoid running untrusted markdown through marked or run marked on a worker thread and set a reasonable time limit to prevent draining resources.Publish Date: 2022-01-14
URL: CVE-2022-21680
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-rrrm-qjm4-v8hf
Release Date: 2024-08-01
Fix Resolution (marked): 4.0.10
Direct dependency fix Resolution (jsdoc-to-markdown): 7.0.0
Fix Resolution (marked): 4.0.10
Direct dependency fix Resolution (jsdoc-to-markdown): 7.0.0
Step up your Open Source Security Game with Mend here
The text was updated successfully, but these errors were encountered: