Version 1.2.3 of the marked npm package, a fast markdown parser, introduces several updates compared to the previous stable version, 1.2.2. Developers will notice improvements primarily in the development dependencies, reflecting a focus on code quality and tooling. Key updates include upgrades to ESLint (from 7.10.0 to 7.12.1), Rollup (from 2.32.1 to 2.33.0), and Highlight.js (from 10.2.0 to 10.3.2). There are also dependency updates and upgrades for @babel/core and @babel/preset-env.
A notable change is the removal of the deprecated markdown dependency (0.5.x), replaced in previous versions by better alternatives. Furthermore, the version increments in ESLint plugins such as eslint-plugin-standard (from 4.0.1 to 4.0.2) suggest refinements in code style enforcement.
These updates, while primarily affecting the development environment, contribute to a more robust and maintainable library. Developers using marked directly might not experience immediate functional changes, but will benefit from the improved stability and updated highlighting capabilities. The increase in unpacked size, though minimal, may reflect slight increases in the underlying code or dependencies necessary for these improvements. The release date shift indicates active maintenance and refinement of the package.
All the vulnerabilities related to the version 1.2.3 of the package
Regular Expression Denial of Service (REDoS) in Marked
What kind of vulnerability is it? Who is impacted?
Regular expression Denial of Service
A Denial of Service attack can affect anyone who runs user generated code through marked.
Has the problem been patched? What versions should users upgrade to?
patched in v2.0.0
Is there a way for users to fix or remediate the vulnerability without upgrading?
None.
Are there any links users can visit to find out more?
https://github.com/markedjs/marked/issues/1927 https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS
If you have any questions or comments about this advisory:
Inefficient Regular Expression Complexity in marked
What kind of vulnerability is it?
Denial of service.
The regular expression inline.reflinkSearch may cause catastrophic backtracking against some strings.
PoC is the following.
import * as marked from 'marked';
console.log(marked.parse(`[x]: x
\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](`));
Who is impacted?
Anyone who runs untrusted markdown through marked and does not use a worker with a time limit.
Has the problem been patched?
Yes
What versions should users upgrade to?
4.0.10
Is there a way for users to fix or remediate the vulnerability without upgrading?
Do not run untrusted markdown through marked or run marked on a worker thread and set a reasonable time limit to prevent draining resources.
Are there any links users can visit to find out more?
If you have any questions or comments about this advisory:
Inefficient Regular Expression Complexity in marked
What kind of vulnerability is it?
Denial of service.
The regular expression block.def may cause catastrophic backtracking against some strings.
PoC is the following.
import * as marked from "marked";
marked.parse(`[x]:${' '.repeat(1500)}x ${' '.repeat(1500)} x`);
Who is impacted?
Anyone who runs untrusted markdown through marked and does not use a worker with a time limit.
Has the problem been patched?
Yes
What versions should users upgrade to?
4.0.10
Is there a way for users to fix or remediate the vulnerability without upgrading?
Do not run untrusted markdown through marked or run marked on a worker thread and set a reasonable time limit to prevent draining resources.
Are there any links users can visit to find out more?
If you have any questions or comments about this advisory: