Marked versions 2.0.0 and 1.2.9 are both iterations of a popular markdown parser designed for speed and efficiency. Examining their metadata reveals subtle yet important distinctions that could influence a developer's choice. Both versions share a common set of development dependencies, including tools for linting (eslint), bundling (rollup), testing (jasmine, cheerio), and automated releases (semantic-release). The core development workflow and tooling appear consistent between the two.
However, version 2.0.0 boasts a slightly larger unpacked size (283889 bytes compared to 267216 bytes in 1.2.9). This suggests potential additions or modifications to the codebase, possibly introducing new features, optimizations, or bug fixes. Furthermore, the release dates indicate a gap of about 4 days between the two versions, with 2.0.0 being the newer release. This likely means that version 2.0.0 incorporates the latest updates and improvements made to the library.
For developers, this implies that opting for version 2.0.0 may grant access to enhanced performance, expanded functionality, or resolutions to previously identified issues. While the shared dependency list signals a familiar environment, the size difference and release date point towards tangible enhancements within the newer version.
All the vulnerabilities related to the version 2.0.0 of the package
Inefficient Regular Expression Complexity in marked
What kind of vulnerability is it?
Denial of service.
The regular expression inline.reflinkSearch may cause catastrophic backtracking against some strings.
PoC is the following.
import * as marked from 'marked';
console.log(marked.parse(`[x]: x
\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](`));
Who is impacted?
Anyone who runs untrusted markdown through marked and does not use a worker with a time limit.
Has the problem been patched?
Yes
What versions should users upgrade to?
4.0.10
Is there a way for users to fix or remediate the vulnerability without upgrading?
Do not run untrusted markdown through marked or run marked on a worker thread and set a reasonable time limit to prevent draining resources.
Are there any links users can visit to find out more?
If you have any questions or comments about this advisory:
Inefficient Regular Expression Complexity in marked
What kind of vulnerability is it?
Denial of service.
The regular expression block.def may cause catastrophic backtracking against some strings.
PoC is the following.
import * as marked from "marked";
marked.parse(`[x]:${' '.repeat(1500)}x ${' '.repeat(1500)} x`);
Who is impacted?
Anyone who runs untrusted markdown through marked and does not use a worker with a time limit.
Has the problem been patched?
Yes
What versions should users upgrade to?
4.0.10
Is there a way for users to fix or remediate the vulnerability without upgrading?
Do not run untrusted markdown through marked or run marked on a worker thread and set a reasonable time limit to prevent draining resources.
Are there any links users can visit to find out more?
If you have any questions or comments about this advisory: