Marked version 3.0.4 represents a minor update over the preceding version 3.0.3, focusing primarily on dependency adjustments and internal refinements. Developers considering an upgrade should note that the core functionality of the markdown parser remains consistent, ensuring minimal disruption to existing implementations. Key differences lie in the devDependencies section.
Specifically, uglify-js has been bumped from 3.14.1 to 3.14.2, suggesting a patch or minor feature addition in the minification process. More significantly, @babel/preset-env sees an update from 7.15.4 to 7.15.6. This likely involves bug fixes or improved support for newer JavaScript features, potentially benefiting developers who are transpiling code that interacts with marked.
While the changes appear incremental, staying current with these dependencies is generally recommended for optimal performance, security, and compatibility. The updated release date, a week later, reflects the time invested in these adjustments. The unpacked size also sees a very slight increase that doesn't seem to be relevant. For users already on the 3.x branch, upgrading to 3.0.4 offers the advantages of the latest dependency updates with minimal risk of introducing breaking changes. Developers can continue to leverage Marked as a fast and reliable markdown parser, benefiting from ongoing maintenance and improvements within its ecosystem.
All the vulnerabilities related to the version 3.0.4 of the package
Inefficient Regular Expression Complexity in marked
What kind of vulnerability is it?
Denial of service.
The regular expression inline.reflinkSearch may cause catastrophic backtracking against some strings.
PoC is the following.
import * as marked from 'marked';
console.log(marked.parse(`[x]: x
\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](`));
Who is impacted?
Anyone who runs untrusted markdown through marked and does not use a worker with a time limit.
Has the problem been patched?
Yes
What versions should users upgrade to?
4.0.10
Is there a way for users to fix or remediate the vulnerability without upgrading?
Do not run untrusted markdown through marked or run marked on a worker thread and set a reasonable time limit to prevent draining resources.
Are there any links users can visit to find out more?
If you have any questions or comments about this advisory:
Inefficient Regular Expression Complexity in marked
What kind of vulnerability is it?
Denial of service.
The regular expression block.def may cause catastrophic backtracking against some strings.
PoC is the following.
import * as marked from "marked";
marked.parse(`[x]:${' '.repeat(1500)}x ${' '.repeat(1500)} x`);
Who is impacted?
Anyone who runs untrusted markdown through marked and does not use a worker with a time limit.
Has the problem been patched?
Yes
What versions should users upgrade to?
4.0.10
Is there a way for users to fix or remediate the vulnerability without upgrading?
Do not run untrusted markdown through marked or run marked on a worker thread and set a reasonable time limit to prevent draining resources.
Are there any links users can visit to find out more?
If you have any questions or comments about this advisory: