Marked versions 2.1.3 and 2.1.2 are both iterations of Christopher Jeffrey's "marked," a fast and lightweight Markdown parsing library designed for JavaScript environments. Developers leveraging Markdown for content generation, documentation, or rendering user input will find these versions valuable, as 'marked' prioritizes speed and ease of integration.
The primary difference between the versions lies in their dependency updates. Version 2.1.3 sees an updated 'commonmark' dependency, moving from version 0.29.3 in 2.1.2 to 0.30.0. This update likely addresses bug fixes or feature enhancements within the CommonMark specification implementation. Furthermore, the unpacked size shows as slightly different, 309889 vs 309673. While seemingly minor, this could signal optimizations, added features, or refactoring within the codebase that impacts the final bundle size. The release dates are also different with a gap of aproximately 3 days. For developers, these changes mean staying up-to-date with the CommonMark standard and potentially benefiting from performance improvements or bug resolutions. While the core functionality of 'marked' remains consistent - converting Markdown text into HTML - these incremental updates contribute to a more robust and optimized parsing experience. Version 2.1.3 represents a subtle but important upgrade for those seeking the latest improvements in Markdown processing.
All the vulnerabilities related to the version 2.1.3 of the package
Inefficient Regular Expression Complexity in marked
What kind of vulnerability is it?
Denial of service.
The regular expression inline.reflinkSearch may cause catastrophic backtracking against some strings.
PoC is the following.
import * as marked from 'marked';
console.log(marked.parse(`[x]: x
\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](`));
Who is impacted?
Anyone who runs untrusted markdown through marked and does not use a worker with a time limit.
Has the problem been patched?
Yes
What versions should users upgrade to?
4.0.10
Is there a way for users to fix or remediate the vulnerability without upgrading?
Do not run untrusted markdown through marked or run marked on a worker thread and set a reasonable time limit to prevent draining resources.
Are there any links users can visit to find out more?
If you have any questions or comments about this advisory:
Inefficient Regular Expression Complexity in marked
What kind of vulnerability is it?
Denial of service.
The regular expression block.def may cause catastrophic backtracking against some strings.
PoC is the following.
import * as marked from "marked";
marked.parse(`[x]:${' '.repeat(1500)}x ${' '.repeat(1500)} x`);
Who is impacted?
Anyone who runs untrusted markdown through marked and does not use a worker with a time limit.
Has the problem been patched?
Yes
What versions should users upgrade to?
4.0.10
Is there a way for users to fix or remediate the vulnerability without upgrading?
Do not run untrusted markdown through marked or run marked on a worker thread and set a reasonable time limit to prevent draining resources.
Are there any links users can visit to find out more?
If you have any questions or comments about this advisory: