Marked is a popular and speedy markdown parser designed for developers seeking efficient and reliable markdown processing. Comparing version 0.3.6 with its predecessor, version 0.3.5, reveals a relatively incremental update focusing primarily on currency and bug fixes, rather than introducing groundbreaking new features. Both versions share the same core development dependencies, including Gulp for build automation, and markdown and showdown for related markdown functionalities. They also use gulp-concat and gulp-uglify to optimize the javascript code for production
The key difference between the versions lies in their release dates. Version 0.3.6 was released on July 30, 2016, a full year after version 0.3.5 which was released on July 31, 2015. This suggests that version 0.3.6 likely incorporates bug fixes, performance improvements and dependency updates accumulated over that development period.
For developers, the choice between versions might hinge on the need for the specific fixes included in the newer release. Given the absence of major feature additions, migrating from 0.3.5 to 0.3.6 should be relatively seamless. Developers should always prioritize using the latest stable version within a major/minor release family and upgrade the package. Staying up-to-date ensures access to the most recent security patches and performance enhancements, keeping their applications running smoothly and securely. Marked remains a solid choice for any project requiring fast and dependable markdown parsing.
All the vulnerabilities related to the version 0.3.6 of the package
Marked vulnerable to XSS from data URIs
marked version 0.3.6 and earlier is vulnerable to an XSS attack in the data: URI parser.
Regular Expression Denial of Service in marked
Affected versions of marked are vulnerable to a regular expression denial of service.
The amplification in this vulnerability is significant, with 1,000 characters resulting in the event loop being blocked for around 6 seconds.
Update to version 0.3.9 or later.
Marked allows Regular Expression Denial of Service (ReDoS) attacks
Marked prior to version 0.3.17 is vulnerable to a Regular Expression Denial of Service (ReDoS) attack due to catastrophic backtracking in several regular expressions used for parsing HTML tags and markdown links. An attacker can exploit this vulnerability by providing specially crafted markdown input, such as deeply nested or repetitively structured brackets or tag attributes, which cause the parser to hang and lead to a Denial of Service.
Inefficient Regular Expression Complexity in marked
What kind of vulnerability is it?
Denial of service.
The regular expression inline.reflinkSearch may cause catastrophic backtracking against some strings.
PoC is the following.
import * as marked from 'marked';
console.log(marked.parse(`[x]: x
\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](`));
Who is impacted?
Anyone who runs untrusted markdown through marked and does not use a worker with a time limit.
Has the problem been patched?
Yes
What versions should users upgrade to?
4.0.10
Is there a way for users to fix or remediate the vulnerability without upgrading?
Do not run untrusted markdown through marked or run marked on a worker thread and set a reasonable time limit to prevent draining resources.
Are there any links users can visit to find out more?
If you have any questions or comments about this advisory:
Inefficient Regular Expression Complexity in marked
What kind of vulnerability is it?
Denial of service.
The regular expression block.def may cause catastrophic backtracking against some strings.
PoC is the following.
import * as marked from "marked";
marked.parse(`[x]:${' '.repeat(1500)}x ${' '.repeat(1500)} x`);
Who is impacted?
Anyone who runs untrusted markdown through marked and does not use a worker with a time limit.
Has the problem been patched?
Yes
What versions should users upgrade to?
4.0.10
Is there a way for users to fix or remediate the vulnerability without upgrading?
Do not run untrusted markdown through marked or run marked on a worker thread and set a reasonable time limit to prevent draining resources.
Are there any links users can visit to find out more?
If you have any questions or comments about this advisory: