GitHub Advisoryadvisory · npm

GHSA-4r62-v4vq-hr96 Regular Expression Denial of Service (REDoS) in Marked

MEDIUM Published 2021-02-08 Modified 2021-02-08 Official page ↗
Aliases
CVE-2021-21306
Ecosystem
npm
Packages
marked
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weaknesses
CWE-400
Reviewed
2021-02-08

Affected packages

• npm marked: >= 1.1.1, < 2.0.0 → fixed in 2.0.0

Description

Impact _What kind of vulnerability is it? Who is impacted?_ Regular expression Denial of Service A Denial of Service attack can affect anyone who runs user generated code through `marked`. Patches _Has the problem been patched? What versions should users upgrade to?_ patched in v2.0.0 Workarounds _Is there a way for users to fix or remediate the vulnerability without upgrading?_ None. References _Are there any links users can visit to find out more?_ https://github.com/markedjs/marked/issues/1927 https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS For more information If you have any questions or comments about this advisory: • Open an issue in marked

Related

Alias · CVE (1)

  • CVE-2021-21306 Marked is an open-source markdown parser and compiler (npm package "marked"). vulnerability

Weakness · CWE (1)

  • CWE-400 Uncontrolled Resource Consumption weakness

References