Content injection in marked

Description

Versions 0.3.7 and earlier of marked When mangling is disabled via option mangle don’t escape target href. This allow attacker to inject arbitrary html-event into resulting a tag.

Recommendation

Update the marked package to the latest compatible version. Followings are version details:

• Affected version(s): < 0.3.9
• Patched version(s): 0.3.9

References

• GHSA-wjmf-58vc-xqjr

Related Issues

• VBScript Content Injection in marked - CVE-2015-1370
• Multiple Content Injection Vulnerabilities in marked - CVE-2014-3743
• appium-desktop OS Command Injection vulnerability - CVE-2023-2479
• chromedriver Command Injection vulnerability - CVE-2023-26156

You might also like:

How do hackers hack websites?

These 7 PHP mistakes leave your website open to the hackers

Update Cheat Sheet for Developers

Tags:

npm

marked