The marked npm package, a fast and reliable markdown parser, saw a minor version update from 1.2.3 to 1.2.4, introducing subtle but potentially important changes for developers. While the core functionality and description remain consistent – a focus on speed for markdown parsing – the development dependencies reveal the evolution of the project's tooling and quality control.
Specifically, eslint was bumped from version 7.12.1 to 7.13.0, and semantic-release from 17.2.1 to 17.2.2, indicating updates to linting rules and automated release management, respectively. Furthermore, eslint-config-standard experienced a significant update, moving from version 14.1.1 to 16.0.1. This signals a shift in adherence to JavaScript coding standards, possibly incorporating newer or stricter guidelines. Uglify-js was upgraded from 3.11.4 to 3.11.5. Rollup also saw a minor upgrade from version 2.33.0 to 2.33.1.
Developers leveraging marked should consider these dependency updates primarily for their impact on the development environment. The changes encourage improved code quality and potentially more consistent builds due to the updated linting configurations. While the core API should remain stable, developers contributing to the marked project or those with highly customized build processes might need to adjust their workflows to accommodate the updated tooling. Finally, the unpacked size increased slightly, from 262889 to 262993.
All the vulnerabilities related to the version 1.2.4 of the package
Regular Expression Denial of Service (REDoS) in Marked
What kind of vulnerability is it? Who is impacted?
Regular expression Denial of Service
A Denial of Service attack can affect anyone who runs user generated code through marked.
Has the problem been patched? What versions should users upgrade to?
patched in v2.0.0
Is there a way for users to fix or remediate the vulnerability without upgrading?
None.
Are there any links users can visit to find out more?
https://github.com/markedjs/marked/issues/1927 https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS
If you have any questions or comments about this advisory:
Inefficient Regular Expression Complexity in marked
What kind of vulnerability is it?
Denial of service.
The regular expression inline.reflinkSearch may cause catastrophic backtracking against some strings.
PoC is the following.
import * as marked from 'marked';
console.log(marked.parse(`[x]: x
\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](`));
Who is impacted?
Anyone who runs untrusted markdown through marked and does not use a worker with a time limit.
Has the problem been patched?
Yes
What versions should users upgrade to?
4.0.10
Is there a way for users to fix or remediate the vulnerability without upgrading?
Do not run untrusted markdown through marked or run marked on a worker thread and set a reasonable time limit to prevent draining resources.
Are there any links users can visit to find out more?
If you have any questions or comments about this advisory:
Inefficient Regular Expression Complexity in marked
What kind of vulnerability is it?
Denial of service.
The regular expression block.def may cause catastrophic backtracking against some strings.
PoC is the following.
import * as marked from "marked";
marked.parse(`[x]:${' '.repeat(1500)}x ${' '.repeat(1500)} x`);
Who is impacted?
Anyone who runs untrusted markdown through marked and does not use a worker with a time limit.
Has the problem been patched?
Yes
What versions should users upgrade to?
4.0.10
Is there a way for users to fix or remediate the vulnerability without upgrading?
Do not run untrusted markdown through marked or run marked on a worker thread and set a reasonable time limit to prevent draining resources.
Are there any links users can visit to find out more?
If you have any questions or comments about this advisory: