Description
Versions 0.3.7 and earlier of marked unescape only lowercase while owsers support both lowercase and uppercase x in hexadecimal form of HTML character entity
Recommendation
Update the marked package to the latest compatible version. Followings are version details:
- Affected version(s): < 0.3.9
- Patched version(s): 0.3.9
References
Related Issues
- jsPDF Denial of Service (DoS) - CVE-2025-57810
- Marked allows Regular Expression Denial of Service (ReDoS) attacks - CVE-2018-25110
- MailDev Remote Code Execution - CVE-2024-27448
- vxe-table prototype pollution - CVE-2024-57080
- Tags:
- npm
- marked
Anything's wrong? Let us know Last updated on January 09, 2023