Marked version 2.1.0 introduces a notable update from the previous stable version, 2.0.7, primarily focusing on refinements and upgrades within its development dependencies. For developers, this translates to an improved underlying toolchain, potentially leading to more efficient builds and a more robust development environment. The most apparent changes are in the updated versions of development dependencies: eslint is updated from 7.27.0 to 7.28.0, @babel/core goes from 7.14.2 to 7.14.5, highlight.js jumps from 10.7.2 to 11.0.1, eslint-plugin-import moves from 2.23.3 to 2.23.4, eslint-plugin-promise evolves from 4.3.1 to 5.1.0, and @semantic-release/release-notes-generator transitions from 9.0.2 to 9.0.3. Additionally, rollup-plugin-license enjoys a significant upgrade from version 2.3.0 to 2.5.0.
While these updates might not directly impact the core functionality of the Marked library for end-users, they signify an ongoing commitment to modernizing the development process. Developers who contribute to or maintain projects leveraging Marked can expect better compatibility with the latest tooling and potentially benefit from the improvements and bug fixes included in these dependency updates. The update to highlight.js is noteworthy as it could potentially bring improved code highlighting capabilities for a wider range of languages and syntax. Furthermore, the unpackedSize in the dist object has increased from 287140 to 310303, this could reflect internal changes with the code that could also be interesting.
All the vulnerabilities related to the version 2.1.0 of the package
Inefficient Regular Expression Complexity in marked
What kind of vulnerability is it?
Denial of service.
The regular expression inline.reflinkSearch may cause catastrophic backtracking against some strings.
PoC is the following.
import * as marked from 'marked';
console.log(marked.parse(`[x]: x
\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](`));
Who is impacted?
Anyone who runs untrusted markdown through marked and does not use a worker with a time limit.
Has the problem been patched?
Yes
What versions should users upgrade to?
4.0.10
Is there a way for users to fix or remediate the vulnerability without upgrading?
Do not run untrusted markdown through marked or run marked on a worker thread and set a reasonable time limit to prevent draining resources.
Are there any links users can visit to find out more?
If you have any questions or comments about this advisory:
Inefficient Regular Expression Complexity in marked
What kind of vulnerability is it?
Denial of service.
The regular expression block.def may cause catastrophic backtracking against some strings.
PoC is the following.
import * as marked from "marked";
marked.parse(`[x]:${' '.repeat(1500)}x ${' '.repeat(1500)} x`);
Who is impacted?
Anyone who runs untrusted markdown through marked and does not use a worker with a time limit.
Has the problem been patched?
Yes
What versions should users upgrade to?
4.0.10
Is there a way for users to fix or remediate the vulnerability without upgrading?
Do not run untrusted markdown through marked or run marked on a worker thread and set a reasonable time limit to prevent draining resources.
Are there any links users can visit to find out more?
If you have any questions or comments about this advisory: