Marked versions 0.6.0 and 0.5.2 are both iterations of a popular Markdown parser designed for speed and ease of use in JavaScript environments. Examining their metadata reveals subtle but potentially impactful differences for developers considering upgrading. Both versions maintain the same core set of development dependencies, signifying a consistent approach to code quality and testing using tools like ESLint for linting, Jasmine for unit testing, and Uglify-js for minification. These dependencies aim to keep the code reliable and optimized.
The key distinction lies in the dist section, specifically the unpackedSize. Version 0.6.0 has an unpacked size of 79675 bytes, slightly larger than version 0.5.2's 77479 bytes. This suggests that version 0.6.0 includes either additional features, optimizations, or expanded test coverage, potentially resulting in enhanced functionality or improved performance. The release date also indicates that version 0.6.0 was released later, on January 1, 2019 while version 0.5.2 was release on November 20, 2018 meaning 0.6.0 is likely to incorporate bug fixes and refinements accumulated since the previous release.
For developers, the upgrade from 0.5.2 to 0.6.0 is worth considering, keeping in mind the small size increase. The newer version likely contains improvements that contribute to a more robust Markdown parsing experience. However, it's always good practice to run tests to make sure of the compatibility of the two versions with the technology stack of the developer.
All the vulnerabilities related to the version 0.6.0 of the package
Marked ReDoS due to email addresses being evaluated in quadratic time
Versions of marked from 0.3.14 until 0.6.2 are vulnerable to Regular Expression Denial of Service. Email addresses may be evaluated in quadratic time, allowing attackers to potentially crash the node process due to resource exhaustion.
Upgrade to version 0.6.2 or later.
Regular Expression Denial of Service in marked
Affected versions of marked are vulnerable to Regular Expression Denial of Service (ReDoS). The _label subrule may significantly degrade parsing performance of malformed input.
Upgrade to version 0.7.0 or later.
Inefficient Regular Expression Complexity in marked
What kind of vulnerability is it?
Denial of service.
The regular expression inline.reflinkSearch may cause catastrophic backtracking against some strings.
PoC is the following.
import * as marked from 'marked';
console.log(marked.parse(`[x]: x
\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](`));
Who is impacted?
Anyone who runs untrusted markdown through marked and does not use a worker with a time limit.
Has the problem been patched?
Yes
What versions should users upgrade to?
4.0.10
Is there a way for users to fix or remediate the vulnerability without upgrading?
Do not run untrusted markdown through marked or run marked on a worker thread and set a reasonable time limit to prevent draining resources.
Are there any links users can visit to find out more?
If you have any questions or comments about this advisory:
Inefficient Regular Expression Complexity in marked
What kind of vulnerability is it?
Denial of service.
The regular expression block.def may cause catastrophic backtracking against some strings.
PoC is the following.
import * as marked from "marked";
marked.parse(`[x]:${' '.repeat(1500)}x ${' '.repeat(1500)} x`);
Who is impacted?
Anyone who runs untrusted markdown through marked and does not use a worker with a time limit.
Has the problem been patched?
Yes
What versions should users upgrade to?
4.0.10
Is there a way for users to fix or remediate the vulnerability without upgrading?
Do not run untrusted markdown through marked or run marked on a worker thread and set a reasonable time limit to prevent draining resources.
Are there any links users can visit to find out more?
If you have any questions or comments about this advisory: