📂 Vulnerable Library - marked-0.3.9.tgz
A markdown parser built for speed
Library home page: https://registry.npmjs.org/marked/-/marked-0.3.9.tgz
Path to dependency file: /package.json
Findings
| Finding |
Severity |
🎯 CVSS |
Exploit Maturity |
EPSS |
Library |
Type |
Fixed in |
Remediation Available |
Reachability |
| CVE-2022-21680 |
🔴 High |
8.7 |
Not Defined |
< 1% |
marked-0.3.9.tgz |
Direct |
marked - 4.0.10 |
✅ |
 Reachable |
| CVE-2022-21681 |
🔴 High |
8.7 |
Not Defined |
< 1% |
marked-0.3.9.tgz |
Direct |
marked - 4.0.10 |
✅ |
Reachable |
| WS-2020-0163 |
🟠 Medium |
5.9 |
N/A |
N/A |
marked-0.3.9.tgz |
Direct |
marked - 1.1.1 |
✅ |
Reachable |
| WS-2018-0628 |
🟠 Medium |
5.3 |
N/A |
N/A |
marked-0.3.9.tgz |
Direct |
marked - 0.4.0 |
✅ |
Reachable |
| WS-2019-0027 |
🟠 Medium |
5.3 |
N/A |
N/A |
marked-0.3.9.tgz |
Direct |
0.3.18 |
✅ |
Reachable |
Details
🔴CVE-2022-21680
Vulnerable Library - marked-0.3.9.tgz
A markdown parser built for speed
Library home page: https://registry.npmjs.org/marked/-/marked-0.3.9.tgz
Path to dependency file: /package.json
Dependency Hierarchy:
- ❌ marked-0.3.9.tgz (Vulnerable Library)
Reachability Analysis
This vulnerability is potentially reachable:
- owasp-nodejs-goat-1.3.0/server.js (Application)
-> ❌ marked-0.3.9/lib/marked.js (Vulnerable Component)
Vulnerability Details
Marked is a markdown parser and compiler. Prior to version 4.0.10, the regular expression "block.def" may cause catastrophic backtracking against some strings and lead to a regular expression denial of service (ReDoS). Anyone who runs untrusted markdown through a vulnerable version of marked and does not use a worker with a time limit may be affected. This issue is patched in version 4.0.10. As a workaround, avoid running untrusted markdown through marked or run marked on a worker thread and set a reasonable time limit to prevent draining resources.
Mend Note: The description of this vulnerability differs from MITRE.
Publish Date: Jan 14, 2022 12:00 AM
URL: CVE-2022-21680
Threat Assessment
Exploit Maturity:Not Defined
EPSS:< 1%
Score: 8.7
Suggested Fix
Type: Upgrade version
Origin: GHSA-rrrm-qjm4-v8hf
Release Date: Jan 14, 2022 12:00 AM
Fix Resolution : marked - 4.0.10
🔴CVE-2022-21681
Vulnerable Library - marked-0.3.9.tgz
A markdown parser built for speed
Library home page: https://registry.npmjs.org/marked/-/marked-0.3.9.tgz
Path to dependency file: /package.json
Dependency Hierarchy:
- ❌ marked-0.3.9.tgz (Vulnerable Library)
Reachability Analysis
This vulnerability is potentially reachable:
- owasp-nodejs-goat-1.3.0/server.js (Application)
-> ❌ marked-0.3.9/lib/marked.js (Vulnerable Component)
Vulnerability Details
Marked is a markdown parser and compiler. Prior to version 4.0.10, the regular expression "inline.reflinkSearch" may cause catastrophic backtracking against some strings and lead to a denial of service (DoS). Anyone who runs untrusted markdown through a vulnerable version of marked and does not use a worker with a time limit may be affected. This issue is patched in version 4.0.10. As a workaround, avoid running untrusted markdown through marked or run marked on a worker thread and set a reasonable time limit to prevent draining resources.
Mend Note: The description of this vulnerability differs from MITRE.
Publish Date: Jan 14, 2022 12:00 AM
URL: CVE-2022-21681
Threat Assessment
Exploit Maturity:Not Defined
EPSS:< 1%
Score: 8.7
Suggested Fix
Type: Upgrade version
Origin: GHSA-5v2h-r2cx-5xgj
Release Date: Jan 14, 2022 12:00 AM
Fix Resolution : marked - 4.0.10
🟠WS-2020-0163
Vulnerable Library - marked-0.3.9.tgz
A markdown parser built for speed
Library home page: https://registry.npmjs.org/marked/-/marked-0.3.9.tgz
Path to dependency file: /package.json
Dependency Hierarchy:
- ❌ marked-0.3.9.tgz (Vulnerable Library)
Reachability Analysis
This vulnerability is potentially reachable:
- owasp-nodejs-goat-1.3.0/server.js (Application)
-> ❌ marked-0.3.9/lib/marked.js (Vulnerable Component)
Vulnerability Details
marked before 1.1.1 is vulnerable to Regular Expression Denial of Service (REDoS). rules.js have multiple unused capture groups which can lead to a Denial of Service.
Publish Date: Jul 02, 2020 12:00 AM
URL: WS-2020-0163
Threat Assessment
Exploit Maturity:N/A
EPSS:N/A
Score: 5.9
Suggested Fix
Type: Upgrade version
Origin: https://github.com/markedjs/marked/releases/tag/v1.1.1
Release Date: Jul 02, 2020 12:00 AM
Fix Resolution : marked - 1.1.1
🟠WS-2018-0628
Vulnerable Library - marked-0.3.9.tgz
A markdown parser built for speed
Library home page: https://registry.npmjs.org/marked/-/marked-0.3.9.tgz
Path to dependency file: /package.json
Dependency Hierarchy:
- ❌ marked-0.3.9.tgz (Vulnerable Library)
Reachability Analysis
This vulnerability is potentially reachable:
- owasp-nodejs-goat-1.3.0/server.js (Application)
-> ❌ marked-0.3.9/lib/marked.js (Vulnerable Component)
Vulnerability Details
marked before 0.4.0 is vulnerable to Regular Expression Denial of Service (REDoS) through heading in marked.js.
Publish Date: Apr 16, 2018 12:00 AM
URL: WS-2018-0628
Threat Assessment
Exploit Maturity:N/A
EPSS:N/A
Score: 5.3
Suggested Fix
Type: Upgrade version
Origin: https://github.com/markedjs/marked/releases/tag/0.4.0
Release Date: Apr 16, 2018 12:00 AM
Fix Resolution : marked - 0.4.0
🟠WS-2019-0027
Vulnerable Library - marked-0.3.9.tgz
A markdown parser built for speed
Library home page: https://registry.npmjs.org/marked/-/marked-0.3.9.tgz
Path to dependency file: /package.json
Dependency Hierarchy:
- ❌ marked-0.3.9.tgz (Vulnerable Library)
Reachability Analysis
This vulnerability is potentially reachable:
- owasp-nodejs-goat-1.3.0/server.js (Application)
-> ❌ marked-0.3.9/lib/marked.js (Vulnerable Component)
Vulnerability Details
Versions 0.3.17 and earlier of marked has Four regexes were vulnerable to catastrophic backtracking. This leaves markdown servers open to a potential REDOS attack.
Publish Date: Feb 26, 2018 04:06 PM
URL: WS-2019-0027
Threat Assessment
Exploit Maturity:N/A
EPSS:N/A
Score: 5.3
Suggested Fix
Type: Upgrade version
Origin: markedjs/marked@b15e42b
Release Date: Feb 26, 2018 04:06 PM
Fix Resolution : 0.3.18
📂 Vulnerable Library - marked-0.3.9.tgz
A markdown parser built for speed
Library home page: https://registry.npmjs.org/marked/-/marked-0.3.9.tgz
Path to dependency file: /package.json
Findings
Details
🔴CVE-2022-21680
Vulnerable Library - marked-0.3.9.tgz
A markdown parser built for speed
Library home page: https://registry.npmjs.org/marked/-/marked-0.3.9.tgz
Path to dependency file: /package.json
Dependency Hierarchy:
Reachability Analysis
This vulnerability is potentially reachable:
Vulnerability Details
Marked is a markdown parser and compiler. Prior to version 4.0.10, the regular expression "block.def" may cause catastrophic backtracking against some strings and lead to a regular expression denial of service (ReDoS). Anyone who runs untrusted markdown through a vulnerable version of marked and does not use a worker with a time limit may be affected. This issue is patched in version 4.0.10. As a workaround, avoid running untrusted markdown through marked or run marked on a worker thread and set a reasonable time limit to prevent draining resources.
Mend Note: The description of this vulnerability differs from MITRE.
Publish Date: Jan 14, 2022 12:00 AM
URL: CVE-2022-21680
Threat Assessment
Exploit Maturity:Not Defined
EPSS:< 1%
Score: 8.7
Suggested Fix
Type: Upgrade version
Origin: GHSA-rrrm-qjm4-v8hf
Release Date: Jan 14, 2022 12:00 AM
Fix Resolution : marked - 4.0.10
🔴CVE-2022-21681
Vulnerable Library - marked-0.3.9.tgz
A markdown parser built for speed
Library home page: https://registry.npmjs.org/marked/-/marked-0.3.9.tgz
Path to dependency file: /package.json
Dependency Hierarchy:
Reachability Analysis
This vulnerability is potentially reachable:
Vulnerability Details
Marked is a markdown parser and compiler. Prior to version 4.0.10, the regular expression "inline.reflinkSearch" may cause catastrophic backtracking against some strings and lead to a denial of service (DoS). Anyone who runs untrusted markdown through a vulnerable version of marked and does not use a worker with a time limit may be affected. This issue is patched in version 4.0.10. As a workaround, avoid running untrusted markdown through marked or run marked on a worker thread and set a reasonable time limit to prevent draining resources.
Mend Note: The description of this vulnerability differs from MITRE.
Publish Date: Jan 14, 2022 12:00 AM
URL: CVE-2022-21681
Threat Assessment
Exploit Maturity:Not Defined
EPSS:< 1%
Score: 8.7
Suggested Fix
Type: Upgrade version
Origin: GHSA-5v2h-r2cx-5xgj
Release Date: Jan 14, 2022 12:00 AM
Fix Resolution : marked - 4.0.10
🟠WS-2020-0163
Vulnerable Library - marked-0.3.9.tgz
A markdown parser built for speed
Library home page: https://registry.npmjs.org/marked/-/marked-0.3.9.tgz
Path to dependency file: /package.json
Dependency Hierarchy:
Reachability Analysis
This vulnerability is potentially reachable:
Vulnerability Details
marked before 1.1.1 is vulnerable to Regular Expression Denial of Service (REDoS). rules.js have multiple unused capture groups which can lead to a Denial of Service.
Publish Date: Jul 02, 2020 12:00 AM
URL: WS-2020-0163
Threat Assessment
Exploit Maturity:N/A
EPSS:N/A
Score: 5.9
Suggested Fix
Type: Upgrade version
Origin: https://github.com/markedjs/marked/releases/tag/v1.1.1
Release Date: Jul 02, 2020 12:00 AM
Fix Resolution : marked - 1.1.1
🟠WS-2018-0628
Vulnerable Library - marked-0.3.9.tgz
A markdown parser built for speed
Library home page: https://registry.npmjs.org/marked/-/marked-0.3.9.tgz
Path to dependency file: /package.json
Dependency Hierarchy:
Reachability Analysis
This vulnerability is potentially reachable:
Vulnerability Details
marked before 0.4.0 is vulnerable to Regular Expression Denial of Service (REDoS) through heading in marked.js.
Publish Date: Apr 16, 2018 12:00 AM
URL: WS-2018-0628
Threat Assessment
Exploit Maturity:N/A
EPSS:N/A
Score: 5.3
Suggested Fix
Type: Upgrade version
Origin: https://github.com/markedjs/marked/releases/tag/0.4.0
Release Date: Apr 16, 2018 12:00 AM
Fix Resolution : marked - 0.4.0
🟠WS-2019-0027
Vulnerable Library - marked-0.3.9.tgz
A markdown parser built for speed
Library home page: https://registry.npmjs.org/marked/-/marked-0.3.9.tgz
Path to dependency file: /package.json
Dependency Hierarchy:
Reachability Analysis
This vulnerability is potentially reachable:
Vulnerability Details
Versions 0.3.17 and earlier of marked has Four regexes were vulnerable to catastrophic backtracking. This leaves markdown servers open to a potential REDOS attack.
Publish Date: Feb 26, 2018 04:06 PM
URL: WS-2019-0027
Threat Assessment
Exploit Maturity:N/A
EPSS:N/A
Score: 5.3
Suggested Fix
Type: Upgrade version
Origin: markedjs/marked@b15e42b
Release Date: Feb 26, 2018 04:06 PM
Fix Resolution : 0.3.18