Marked is a popular and speedy markdown parser designed for developers seeking efficient text conversion. Version 0.3.12 introduces key updates and additions compared to its predecessor, version 0.3.9, refining its capabilities for modern development workflows. While both versions share the same core description and maintain essential development dependencies like Gulp for task automation, markdown and showdown for markdown functionalities, and gulp-concat and gulp-uglify for asset management, version 0.3.12 expands its feature set.
Specifically, version 0.3.12 integrates markdown-it, another markdown parser, potentially offering developers more flexibility and options for markdown processing. Furthermore, it incorporates front-matter for parsing front matter from files (making potentially easier to work with static site generators) and glob-to-regexp for converting glob patterns to regular expressions to enhance file handling and manipulation. These additions provide enhanced extensibility and broaden Marked's utility in diverse development scenarios. The later release date of version 0.3.12 (2018-01-09) compared to version 0.3.9 (2017-12-23) indicates that it includes bug fixes, performance improvements and potentially addresses security vulnerabilities identified in the previous version. Developers should consider migrating to version 0.3.12 to leverage these advancements and ensure a more robust and secure markdown processing experience.
All the vulnerabilities related to the version 0.3.12 of the package
Marked allows Regular Expression Denial of Service (ReDoS) attacks
Marked prior to version 0.3.17 is vulnerable to a Regular Expression Denial of Service (ReDoS) attack due to catastrophic backtracking in several regular expressions used for parsing HTML tags and markdown links. An attacker can exploit this vulnerability by providing specially crafted markdown input, such as deeply nested or repetitively structured brackets or tag attributes, which cause the parser to hang and lead to a Denial of Service.
Inefficient Regular Expression Complexity in marked
What kind of vulnerability is it?
Denial of service.
The regular expression inline.reflinkSearch may cause catastrophic backtracking against some strings.
PoC is the following.
import * as marked from 'marked';
console.log(marked.parse(`[x]: x
\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](`));
Who is impacted?
Anyone who runs untrusted markdown through marked and does not use a worker with a time limit.
Has the problem been patched?
Yes
What versions should users upgrade to?
4.0.10
Is there a way for users to fix or remediate the vulnerability without upgrading?
Do not run untrusted markdown through marked or run marked on a worker thread and set a reasonable time limit to prevent draining resources.
Are there any links users can visit to find out more?
If you have any questions or comments about this advisory:
Inefficient Regular Expression Complexity in marked
What kind of vulnerability is it?
Denial of service.
The regular expression block.def may cause catastrophic backtracking against some strings.
PoC is the following.
import * as marked from "marked";
marked.parse(`[x]:${' '.repeat(1500)}x ${' '.repeat(1500)} x`);
Who is impacted?
Anyone who runs untrusted markdown through marked and does not use a worker with a time limit.
Has the problem been patched?
Yes
What versions should users upgrade to?
4.0.10
Is there a way for users to fix or remediate the vulnerability without upgrading?
Do not run untrusted markdown through marked or run marked on a worker thread and set a reasonable time limit to prevent draining resources.
Are there any links users can visit to find out more?
If you have any questions or comments about this advisory: