Description
Versions 0.3.7 and earlier of marked When mangling is disabled via option mangle don’t escape target href. This allow attacker to inject arbitrary html-event into resulting a tag.
Recommendation
Update the marked package to the latest compatible version. Followings are version details:
- Affected version(s): < 0.3.9
- Patched version(s): 0.3.9
References
Related Issues
- Marked allows Regular Expression Denial of Service (ReDoS) attacks - CVE-2018-25110
- Prototype Pollution in Ajv - CVE-2020-15366
- Regular Expression Denial of Service in marked - CVE-2015-8854
- Inefficient Regular Expression Complexity in marked - CVE-2022-21680
- Tags:
- npm
- marked
Anything's wrong? Let us know Last updated on January 09, 2023