The npm package marked offers a fast and reliable markdown parsing solution for developers. Comparing version 1.2.8 to the previous stable version 1.2.7, several changes emerge primarily in the devDependencies section, reflecting updates to the development and testing environment rather than core functionality. For instance, eslint jumps from version 7.15.0 to 7.18.0, rollup moves from 2.34.2 to 2.38.0, and highlight.js sees an update from 10.4.1 to 10.5.0. markdown-it gets bumped from 12.0.3 to 12.0.4. There are also updates in @babel/core, @babel/preset-env, @rollup/plugin-babel and others.
These updates suggest ongoing improvements to code linting, bundling, and syntax highlighting, ensuring a more modern and efficient development workflow for marked's maintainers. While these changes may not directly impact the end-user experience, they contribute to the overall stability and maintainability of the library. The release date difference highlights active development, with 1.2.8 released about a month after 1.2.7, showing commitment of the maintainers on keeping dependency up to date. The unpackedSize also increased slightly, from 266709 to 266885, which could be a result of the dependency upgrades. For developers using marked, these updates reinforce the package's reliability and the dedication to utilizing the latest tools and best practices.
All the vulnerabilities related to the version 1.2.8 of the package
Regular Expression Denial of Service (REDoS) in Marked
What kind of vulnerability is it? Who is impacted?
Regular expression Denial of Service
A Denial of Service attack can affect anyone who runs user generated code through marked.
Has the problem been patched? What versions should users upgrade to?
patched in v2.0.0
Is there a way for users to fix or remediate the vulnerability without upgrading?
None.
Are there any links users can visit to find out more?
https://github.com/markedjs/marked/issues/1927 https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS
If you have any questions or comments about this advisory:
Inefficient Regular Expression Complexity in marked
What kind of vulnerability is it?
Denial of service.
The regular expression inline.reflinkSearch may cause catastrophic backtracking against some strings.
PoC is the following.
import * as marked from 'marked';
console.log(marked.parse(`[x]: x
\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](`));
Who is impacted?
Anyone who runs untrusted markdown through marked and does not use a worker with a time limit.
Has the problem been patched?
Yes
What versions should users upgrade to?
4.0.10
Is there a way for users to fix or remediate the vulnerability without upgrading?
Do not run untrusted markdown through marked or run marked on a worker thread and set a reasonable time limit to prevent draining resources.
Are there any links users can visit to find out more?
If you have any questions or comments about this advisory:
Inefficient Regular Expression Complexity in marked
What kind of vulnerability is it?
Denial of service.
The regular expression block.def may cause catastrophic backtracking against some strings.
PoC is the following.
import * as marked from "marked";
marked.parse(`[x]:${' '.repeat(1500)}x ${' '.repeat(1500)} x`);
Who is impacted?
Anyone who runs untrusted markdown through marked and does not use a worker with a time limit.
Has the problem been patched?
Yes
What versions should users upgrade to?
4.0.10
Is there a way for users to fix or remediate the vulnerability without upgrading?
Do not run untrusted markdown through marked or run marked on a worker thread and set a reasonable time limit to prevent draining resources.
Are there any links users can visit to find out more?
If you have any questions or comments about this advisory: