Description
Versions 0.3.7 and earlier of marked unescape only lowercase while owsers support both lowercase and uppercase x in hexadecimal form of HTML character entity
Recommendation
Update the marked package to the latest compatible version. Followings are version details:
- Affected version(s): < 0.3.9
- Patched version(s): 0.3.9
References
Related Issues
- @hpke/core reuses AEAD nonces - CVE-2025-64767
- Spoofing attack in swagger-ui - CVE-2018-25031
- Marked allows Regular Expression Denial of Service (ReDoS) attacks - CVE-2018-25110
- MailDev Remote Code Execution - CVE-2024-27448
- Tags:
- npm
- marked
Anything's wrong? Let us know Last updated on January 09, 2023