Cross-Site Scripting in marked

Description

Versions 0.3.7 and earlier of marked unescape only lowercase while owsers support both lowercase and uppercase x in hexadecimal form of HTML character entity

Recommendation

Update the marked package to the latest compatible version. Followings are version details:

• Affected version(s): < 0.3.9
• Patched version(s): 0.3.9

References

• GHSA-8wp3-cp9v-44fm

Related Issues

• textAngular Cross-site Scripting vulnerability - CVE-2021-32854
• @dependencytrack/frontend vulnerable to Persistent Cross-Site-Scripting via Vulnerability Details - CVE-2022-39350
• Bootstrap Cross-Site Scripting (XSS) vulnerability - CVE-2024-6531
• CKEditor 5 cross-site scripting (XSS) vulnerability in the clipboard package - CVE-2025-58064

Tags:

npm

marked