Marked versions 0.3.15 and 0.3.16 are both markdown parsers designed for speed, targeting developers who need a reliable tool for converting markdown into HTML. Examining the differences, version 0.3.16, released on February 20, 2018, shows an incremental update over version 0.3.15, released just a day earlier on February 19, 2018. While the core description, development dependencies (including popular libraries like markdown, showdown, uglify-js, markdown-it, front-matter, and glob-to-regexp), license (MIT), and author (Christopher Jeffrey) remain consistent, the distinguishing factors lie in the dist object.
Specifically, version 0.3.16 has a slightly larger unpacked size of 77481 bytes compared to 0.3.15's 75158 bytes, and includes 16 files in the distributed tarball, unlike the previous version that contained 15. This implies that version 0.3.16 potentially incorporates minor bug fixes, performance tweaks, or small feature additions not present in version 0.3.15. Developers choosing between these versions should consider that 0.3.16, while very similar, likely offers a more refined and potentially more stable experience due to these subtle improvements. The quick release succession indicates efforts toward rapid iteration and improvement within the project. As markdown parsing is crucial for documentation generation, content management systems, and various other applications, this commitment to refining the library assures maintained performance and reliability for developers needing a fast and efficient markdown parser.
All the vulnerabilities related to the version 0.3.16 of the package
Marked allows Regular Expression Denial of Service (ReDoS) attacks
Marked prior to version 0.3.17 is vulnerable to a Regular Expression Denial of Service (ReDoS) attack due to catastrophic backtracking in several regular expressions used for parsing HTML tags and markdown links. An attacker can exploit this vulnerability by providing specially crafted markdown input, such as deeply nested or repetitively structured brackets or tag attributes, which cause the parser to hang and lead to a Denial of Service.
Marked ReDoS due to email addresses being evaluated in quadratic time
Versions of marked from 0.3.14 until 0.6.2 are vulnerable to Regular Expression Denial of Service. Email addresses may be evaluated in quadratic time, allowing attackers to potentially crash the node process due to resource exhaustion.
Upgrade to version 0.6.2 or later.
Inefficient Regular Expression Complexity in marked
What kind of vulnerability is it?
Denial of service.
The regular expression inline.reflinkSearch may cause catastrophic backtracking against some strings.
PoC is the following.
import * as marked from 'marked';
console.log(marked.parse(`[x]: x
\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](`));
Who is impacted?
Anyone who runs untrusted markdown through marked and does not use a worker with a time limit.
Has the problem been patched?
Yes
What versions should users upgrade to?
4.0.10
Is there a way for users to fix or remediate the vulnerability without upgrading?
Do not run untrusted markdown through marked or run marked on a worker thread and set a reasonable time limit to prevent draining resources.
Are there any links users can visit to find out more?
If you have any questions or comments about this advisory:
Inefficient Regular Expression Complexity in marked
What kind of vulnerability is it?
Denial of service.
The regular expression block.def may cause catastrophic backtracking against some strings.
PoC is the following.
import * as marked from "marked";
marked.parse(`[x]:${' '.repeat(1500)}x ${' '.repeat(1500)} x`);
Who is impacted?
Anyone who runs untrusted markdown through marked and does not use a worker with a time limit.
Has the problem been patched?
Yes
What versions should users upgrade to?
4.0.10
Is there a way for users to fix or remediate the vulnerability without upgrading?
Do not run untrusted markdown through marked or run marked on a worker thread and set a reasonable time limit to prevent draining resources.
Are there any links users can visit to find out more?
If you have any questions or comments about this advisory: