Marked versions 1.2.5 and 1.2.4 represent incremental updates to a popular markdown parsing library designed for speed and efficiency. Subtle differences in their development dependencies indicate iterative improvements in the build and release process. Specifically, version 1.2.5 sees updates to rollup (from 2.33.1 to 2.33.2), semantic-release (from 17.2.2 to 17.2.3), @markedjs/html-differ (from 3.0.3 to 3.0.4), @semantic-release/github (from 7.1.1 to 7.1.2), and eslint-plugin-standard (from 4.0.2 to 4.1.0). These changes likely incorporate bug fixes, performance enhancements, or new features within the development tooling, aimed at streamlining the library's maintenance and deployment.
For developers integrating Marked into their projects, these updates signify a commitment to stability and modern development practices. The upgrades to semantic-release components suggest a refined automated release pipeline, leading to more predictable and reliable updates. While the core markdown parsing functionality remains consistent between these versions, developers benefit from an improved development ecosystem, potentially leading to faster issue resolution and a more robust library overall. The minor version bumps in dependencies suggest a smooth upgrade path with minimal breaking changes for existing users. The unpacked size difference, although minor, could point to small optimizations. Upgrading from 1.2.4 to 1.2.5 offers a step towards latest best practices and tooling within the Marked ecosystem.
All the vulnerabilities related to the version 1.2.5 of the package
Regular Expression Denial of Service (REDoS) in Marked
What kind of vulnerability is it? Who is impacted?
Regular expression Denial of Service
A Denial of Service attack can affect anyone who runs user generated code through marked.
Has the problem been patched? What versions should users upgrade to?
patched in v2.0.0
Is there a way for users to fix or remediate the vulnerability without upgrading?
None.
Are there any links users can visit to find out more?
https://github.com/markedjs/marked/issues/1927 https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS
If you have any questions or comments about this advisory:
Inefficient Regular Expression Complexity in marked
What kind of vulnerability is it?
Denial of service.
The regular expression inline.reflinkSearch may cause catastrophic backtracking against some strings.
PoC is the following.
import * as marked from 'marked';
console.log(marked.parse(`[x]: x
\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](`));
Who is impacted?
Anyone who runs untrusted markdown through marked and does not use a worker with a time limit.
Has the problem been patched?
Yes
What versions should users upgrade to?
4.0.10
Is there a way for users to fix or remediate the vulnerability without upgrading?
Do not run untrusted markdown through marked or run marked on a worker thread and set a reasonable time limit to prevent draining resources.
Are there any links users can visit to find out more?
If you have any questions or comments about this advisory:
Inefficient Regular Expression Complexity in marked
What kind of vulnerability is it?
Denial of service.
The regular expression block.def may cause catastrophic backtracking against some strings.
PoC is the following.
import * as marked from "marked";
marked.parse(`[x]:${' '.repeat(1500)}x ${' '.repeat(1500)} x`);
Who is impacted?
Anyone who runs untrusted markdown through marked and does not use a worker with a time limit.
Has the problem been patched?
Yes
What versions should users upgrade to?
4.0.10
Is there a way for users to fix or remediate the vulnerability without upgrading?
Do not run untrusted markdown through marked or run marked on a worker thread and set a reasonable time limit to prevent draining resources.
Are there any links users can visit to find out more?
If you have any questions or comments about this advisory: