Marked is a lightweight and speedy markdown parser designed for developers needing to convert markdown text into HTML. Versions 0.3.14 and 0.3.15 share a similar core feature set, offering robust markdown parsing capabilities. Both versions boast the same set of development dependencies, including tools like markdown, showdown, uglify-js, markdown-it, front-matter, and glob-to-regexp, suggesting similar build and testing environments. This consistent dependency structure indicates that upgrading between these versions should be relatively seamless for developers, minimizing the risk of dependency conflicts.
Crucially, both version 0.3.14 and 0.3.15 come with the same fileCount of 15 and unpackedSize of 75158 so the packages contain the same number of files and have the same size after unpacking.
The primary difference between these two versions lies in their release dates. Version 0.3.14 was released on February 16, 2018, while version 0.3.15 followed shortly after on February 19, 2018. This very narrow timeframe suggests that version 0.3.15 is likely a patch release addressing minor bugs or incorporating small improvements discovered shortly after the release of 0.3.14. The updates are small or the team would have updated the number of files or package size within the packages.
Developers already using Marked should consider upgrading from 0.3.14 to 0.3.15 to benefit from these potential bug fixes and improvements, ensuring a more stable and reliable markdown parsing experience.
All the vulnerabilities related to the version 0.3.15 of the package
Marked allows Regular Expression Denial of Service (ReDoS) attacks
Marked prior to version 0.3.17 is vulnerable to a Regular Expression Denial of Service (ReDoS) attack due to catastrophic backtracking in several regular expressions used for parsing HTML tags and markdown links. An attacker can exploit this vulnerability by providing specially crafted markdown input, such as deeply nested or repetitively structured brackets or tag attributes, which cause the parser to hang and lead to a Denial of Service.
Marked ReDoS due to email addresses being evaluated in quadratic time
Versions of marked from 0.3.14 until 0.6.2 are vulnerable to Regular Expression Denial of Service. Email addresses may be evaluated in quadratic time, allowing attackers to potentially crash the node process due to resource exhaustion.
Upgrade to version 0.6.2 or later.
Inefficient Regular Expression Complexity in marked
What kind of vulnerability is it?
Denial of service.
The regular expression inline.reflinkSearch may cause catastrophic backtracking against some strings.
PoC is the following.
import * as marked from 'marked';
console.log(marked.parse(`[x]: x
\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](`));
Who is impacted?
Anyone who runs untrusted markdown through marked and does not use a worker with a time limit.
Has the problem been patched?
Yes
What versions should users upgrade to?
4.0.10
Is there a way for users to fix or remediate the vulnerability without upgrading?
Do not run untrusted markdown through marked or run marked on a worker thread and set a reasonable time limit to prevent draining resources.
Are there any links users can visit to find out more?
If you have any questions or comments about this advisory:
Inefficient Regular Expression Complexity in marked
What kind of vulnerability is it?
Denial of service.
The regular expression block.def may cause catastrophic backtracking against some strings.
PoC is the following.
import * as marked from "marked";
marked.parse(`[x]:${' '.repeat(1500)}x ${' '.repeat(1500)} x`);
Who is impacted?
Anyone who runs untrusted markdown through marked and does not use a worker with a time limit.
Has the problem been patched?
Yes
What versions should users upgrade to?
4.0.10
Is there a way for users to fix or remediate the vulnerability without upgrading?
Do not run untrusted markdown through marked or run marked on a worker thread and set a reasonable time limit to prevent draining resources.
Are there any links users can visit to find out more?
If you have any questions or comments about this advisory: