Content injection in marked

Description

Versions 0.3.7 and earlier of marked When mangling is disabled via option mangle don’t escape target href. This allow attacker to inject arbitrary html-event into resulting a tag.

Recommendation

Update the marked package to the latest compatible version. Followings are version details:

• Affected version(s): < 0.3.9
• Patched version(s): 0.3.9

References

• GHSA-wjmf-58vc-xqjr

Related Issues

• VBScript Content Injection in marked - CVE-2015-1370
• Multiple Content Injection Vulnerabilities in marked - CVE-2014-3743
• systeminformation SSID Command Injection Vulnerability - CVE-2023-42810
• FUXA SQL Injection vulnerability (GHSA-p46g-8c3q-89p2) - CVE-2023-31719

Tags:

npm

marked