Marked version 2.0.7 is a minor patch release following 2.0.6, both versions maintaining the core focus on being a fast markdown parser suitable for a variety of applications. Developers considering upgrading should primarily note the subtle differences in the development dependencies, as these potentially reflect underlying adjustments in the build or testing processes.
Specifically, rollup sees an update from version 2.49.0 to 2.50.5 and eslint-config-standard updates from version 16.0.2 to 16.0.3. The uglify-js dependency is upgraded from 3.13.7 to 3.13.8. While seemingly minor, these upgrades often include bug fixes, performance improvements, and security patches within the respective development tools, ensuring a more robust and secure development pipeline for the marked library itself. These changes are unlikely to drastically alter the end-user experience, however, they contribute to the overall stability and maintainability of the package for developers relying on marked in their projects.
Furthermore, the unpackedSize listed in the dist section slightly decreases (287545 to 287140). The releaseDate also confirms the recency of version 2.0.7, indicating an active maintenance cycle. For users primarily concerned with the core markdown parsing functionality, the changes are incremental and represent a commitment to ongoing improvements rather than a major overhaul. Developers are always encouraged to review the changelog for the specific fixes and enhancements included in these minor updates.
All the vulnerabilities related to the version 2.0.7 of the package
Inefficient Regular Expression Complexity in marked
What kind of vulnerability is it?
Denial of service.
The regular expression inline.reflinkSearch may cause catastrophic backtracking against some strings.
PoC is the following.
import * as marked from 'marked';
console.log(marked.parse(`[x]: x
\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](`));
Who is impacted?
Anyone who runs untrusted markdown through marked and does not use a worker with a time limit.
Has the problem been patched?
Yes
What versions should users upgrade to?
4.0.10
Is there a way for users to fix or remediate the vulnerability without upgrading?
Do not run untrusted markdown through marked or run marked on a worker thread and set a reasonable time limit to prevent draining resources.
Are there any links users can visit to find out more?
If you have any questions or comments about this advisory:
Inefficient Regular Expression Complexity in marked
What kind of vulnerability is it?
Denial of service.
The regular expression block.def may cause catastrophic backtracking against some strings.
PoC is the following.
import * as marked from "marked";
marked.parse(`[x]:${' '.repeat(1500)}x ${' '.repeat(1500)} x`);
Who is impacted?
Anyone who runs untrusted markdown through marked and does not use a worker with a time limit.
Has the problem been patched?
Yes
What versions should users upgrade to?
4.0.10
Is there a way for users to fix or remediate the vulnerability without upgrading?
Do not run untrusted markdown through marked or run marked on a worker thread and set a reasonable time limit to prevent draining resources.
Are there any links users can visit to find out more?
If you have any questions or comments about this advisory: