Marked versions 1.2.6 and 1.2.5 represent incremental updates to this popular and speedy Markdown parser designed for JavaScript environments, both client-side and server-side. While the core functionality remains consistent, several dependency updates in the devDependencies offer subtle improvements in development workflows and potentially enhanced security and compatibility for developers utilizing the library.
Specifically, version 1.2.6 features updates to key tools like eslint (from 7.13.0 to 7.15.0), @babel/core (from 7.12.3 to 7.12.9), highlight.js (from 10.3.2 to 10.4.1), semantic-release (from 17.2.3 to 17.3.0), @babel/preset-env (from 7.12.1 to 7.12.7), rollup (from 2.33.2 to 2.34.2), eslint-config-standard (from 16.0.1 to 16.0.2), and @semantic-release/npm (from 7.0.6 to 7.0.9). Uglify-js has also been updated from 3.11.6 to 3.12.1. These updates likely bring bug fixes, performance enhancements, and new features to the development process, and potentially impact the final bundle size and runtime behavior of Marked. The update to highlight.js brings support for new languages and improved code highlighting. Removed eslint-plugin-standard.
For developers, it's advisable to upgrade to version 1.2.6 to leverage these improvements. Checking the changelogs of the updated dependencies is recommended to fully understand the scope of these changes. The core Markdown parsing capabilities remain consistent, ensuring minimal disruption to existing implementations. This upgrade ensures access to a more robust and efficient development environment with the latest tooling.
All the vulnerabilities related to the version 1.2.6 of the package
Regular Expression Denial of Service (REDoS) in Marked
What kind of vulnerability is it? Who is impacted?
Regular expression Denial of Service
A Denial of Service attack can affect anyone who runs user generated code through marked.
Has the problem been patched? What versions should users upgrade to?
patched in v2.0.0
Is there a way for users to fix or remediate the vulnerability without upgrading?
None.
Are there any links users can visit to find out more?
https://github.com/markedjs/marked/issues/1927 https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS
If you have any questions or comments about this advisory:
Inefficient Regular Expression Complexity in marked
What kind of vulnerability is it?
Denial of service.
The regular expression inline.reflinkSearch may cause catastrophic backtracking against some strings.
PoC is the following.
import * as marked from 'marked';
console.log(marked.parse(`[x]: x
\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](`));
Who is impacted?
Anyone who runs untrusted markdown through marked and does not use a worker with a time limit.
Has the problem been patched?
Yes
What versions should users upgrade to?
4.0.10
Is there a way for users to fix or remediate the vulnerability without upgrading?
Do not run untrusted markdown through marked or run marked on a worker thread and set a reasonable time limit to prevent draining resources.
Are there any links users can visit to find out more?
If you have any questions or comments about this advisory:
Inefficient Regular Expression Complexity in marked
What kind of vulnerability is it?
Denial of service.
The regular expression block.def may cause catastrophic backtracking against some strings.
PoC is the following.
import * as marked from "marked";
marked.parse(`[x]:${' '.repeat(1500)}x ${' '.repeat(1500)} x`);
Who is impacted?
Anyone who runs untrusted markdown through marked and does not use a worker with a time limit.
Has the problem been patched?
Yes
What versions should users upgrade to?
4.0.10
Is there a way for users to fix or remediate the vulnerability without upgrading?
Do not run untrusted markdown through marked or run marked on a worker thread and set a reasonable time limit to prevent draining resources.
Are there any links users can visit to find out more?
If you have any questions or comments about this advisory: