Description
Affected versions of marked are susceptible to a cross-site scripting vulnerability in link components when sanitize:true is configured.
Recommendation
Update the marked package to the latest compatible version. Followings are version details:
- Affected version(s): < 0.3.6
- Patched version(s): 0.3.6
References
Related Issues
- Bypassing Sanitization using DOM clobbering in html-janitor - CVE-2017-0928
- Unhead has a hasDangerousProtocol() bypass via leading-zero padded HTML entities in useHeadSafe() - CVE-2026-39315
- TinyMCE Cross-Site Scripting (XSS) vulnerability using sanitization bypass through nested SVGs - CVE-2026-47760
- Unhead Vulnerable to Bypass of URI Scheme Sanitization in makeTagSafe via Case-Sensitivity - CVE-2026-31873
You might also like:
- Tags:
- npm
- marked
Anything's wrong? Let us know Last updated on September 07, 2023