Description
Denial of service.
The regular expression inline.reflinkSearch may cause catastrophic backtracking against some strings. PoC is the following.
Who is impacted?
Anyone who runs untrusted markdown through marked and does not use a worker with a time limit.
Recommendation
Update the marked package to the latest compatible version. Followings are version details:
- Affected version(s): < 4.0.10
- Patched version(s): 4.0.10
References
Could your website be exposed too?
SmartScanner can check your website for Inefficient Regular Expression Complexity in marked - marked and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Inefficient Regular Expression Complexity in marked - CVE-2022-21680
- steal Inefficient Regular Expression Complexity vulnerability via string variable - CVE-2022-37259
- Moment.js vulnerable to Inefficient Regular Expression Complexity - CVE-2022-31129
- v8n vulnerable to Inefficient Regular Expression Complexity - CVE-2022-35923
You might also like:
See something that needs correcting? Let us knowUpdated November 29, 2023