Marked version 1.2.2 represents a minor update over its predecessor, version 1.2.1, within the popular marked npm package, a fast and efficient markdown parser designed for developers who prioritize speed and accuracy. Examining the metadata, the core functionalities and development dependencies remain largely consistent between the two versions, suggesting that the update likely focuses on bug fixes, performance improvements, or minor feature enhancements rather than a complete overhaul. Both versions share an identical suite of development dependencies, including tools for linting (eslint), bundling (rollup), testing (jasmine, commonmark), and semantic release automation. These dependencies ensure code quality, efficient distribution, and streamlined release processes.
However, subtle differences emerge in the dist object. Version 1.2.2 has a fileCount of 19 and a slightly smaller unpackedSize of 261092 bytes compared to version 1.2.1's fileCount of 20 and unpackedSize of 264064 bytes. This may indicate that the newer version incorporates optimizations that reduce the overall package size, potentially leading to faster download and installation times for users. Furthermore, version 1.2.2 has a later releaseDate, indicating a more recent build. While the changelog remains elusive in this data, developers are recommended to review the official marked repository on GitHub for detailed release notes outlining the specific changes incorporated in version 1.2.2. Potential improvements could involve handling edge cases, fixing security vulnerabilities, or fine-tuning the markdown parsing engine for better performance.
All the vulnerabilities related to the version 1.2.2 of the package
Regular Expression Denial of Service (REDoS) in Marked
What kind of vulnerability is it? Who is impacted?
Regular expression Denial of Service
A Denial of Service attack can affect anyone who runs user generated code through marked.
Has the problem been patched? What versions should users upgrade to?
patched in v2.0.0
Is there a way for users to fix or remediate the vulnerability without upgrading?
None.
Are there any links users can visit to find out more?
https://github.com/markedjs/marked/issues/1927 https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS
If you have any questions or comments about this advisory:
Inefficient Regular Expression Complexity in marked
What kind of vulnerability is it?
Denial of service.
The regular expression inline.reflinkSearch may cause catastrophic backtracking against some strings.
PoC is the following.
import * as marked from 'marked';
console.log(marked.parse(`[x]: x
\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](`));
Who is impacted?
Anyone who runs untrusted markdown through marked and does not use a worker with a time limit.
Has the problem been patched?
Yes
What versions should users upgrade to?
4.0.10
Is there a way for users to fix or remediate the vulnerability without upgrading?
Do not run untrusted markdown through marked or run marked on a worker thread and set a reasonable time limit to prevent draining resources.
Are there any links users can visit to find out more?
If you have any questions or comments about this advisory:
Inefficient Regular Expression Complexity in marked
What kind of vulnerability is it?
Denial of service.
The regular expression block.def may cause catastrophic backtracking against some strings.
PoC is the following.
import * as marked from "marked";
marked.parse(`[x]:${' '.repeat(1500)}x ${' '.repeat(1500)} x`);
Who is impacted?
Anyone who runs untrusted markdown through marked and does not use a worker with a time limit.
Has the problem been patched?
Yes
What versions should users upgrade to?
4.0.10
Is there a way for users to fix or remediate the vulnerability without upgrading?
Do not run untrusted markdown through marked or run marked on a worker thread and set a reasonable time limit to prevent draining resources.
Are there any links users can visit to find out more?
If you have any questions or comments about this advisory: