Marked-man is a handy wrapper designed to extend the functionality of the popular 'marked' Markdown parser by enabling the generation of man page output, drawing inspiration from the 'ronn' tool. Version 0.2.1, released on March 31, 2017, follows its predecessor, version 0.2.0, which came out on December 9, 2016. While the core functionality remains consistent – providing a seamless way to create man pages directly from Markdown files – subtle improvements and fixes are likely incorporated in the newer version. Both versions share the same fundamental architecture, relying on 'marked' version ^0.3.2 as a dependency.
For developers seeking a streamlined solution for documentation, Marked-man offers a convenient bridge between Markdown's simplicity and the structured format of man pages. The MIT license ensures flexibility for integration into various projects. The tool, maintained with publicly on GitHub, allows developers to contribute and stay updated. Upgrading from version 0.2.0 to 0.2.1 ensures that you benefit from any incremental bug fixes, performance enhancements, or compatibility adjustments that have been implemented. Keep an eye to the release in the future. Since the only difference known are the release date, it should be checked for fixes and if there are, the upgrade is valuable.
All the vulnerabilities related to the version 0.2.1 of the package
Inefficient Regular Expression Complexity in marked
What kind of vulnerability is it?
Denial of service.
The regular expression inline.reflinkSearch may cause catastrophic backtracking against some strings.
PoC is the following.
import * as marked from 'marked';
console.log(marked.parse(`[x]: x
\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](`));
Who is impacted?
Anyone who runs untrusted markdown through marked and does not use a worker with a time limit.
Has the problem been patched?
Yes
What versions should users upgrade to?
4.0.10
Is there a way for users to fix or remediate the vulnerability without upgrading?
Do not run untrusted markdown through marked or run marked on a worker thread and set a reasonable time limit to prevent draining resources.
Are there any links users can visit to find out more?
If you have any questions or comments about this advisory:
Inefficient Regular Expression Complexity in marked
What kind of vulnerability is it?
Denial of service.
The regular expression block.def may cause catastrophic backtracking against some strings.
PoC is the following.
import * as marked from "marked";
marked.parse(`[x]:${' '.repeat(1500)}x ${' '.repeat(1500)} x`);
Who is impacted?
Anyone who runs untrusted markdown through marked and does not use a worker with a time limit.
Has the problem been patched?
Yes
What versions should users upgrade to?
4.0.10
Is there a way for users to fix or remediate the vulnerability without upgrading?
Do not run untrusted markdown through marked or run marked on a worker thread and set a reasonable time limit to prevent draining resources.
Are there any links users can visit to find out more?
If you have any questions or comments about this advisory:
Marked ReDoS due to email addresses being evaluated in quadratic time
Versions of marked from 0.3.14 until 0.6.2 are vulnerable to Regular Expression Denial of Service. Email addresses may be evaluated in quadratic time, allowing attackers to potentially crash the node process due to resource exhaustion.
Upgrade to version 0.6.2 or later.