marked vulnerabilities
A markdown parser built for speed
- Registry
- npm
- Latest
- 18.1.1
- License
- MIT
13 known advisories
The latest version, 18.1.1, is not affected by any of them. Projects on older versions may be.
npm install marked@18.1.1Security advisories for marked
Marked Vulnerable to OOM Denial of Service via Infinite Recursion in marked Tokenizer
- Affected
- >=18.0.0 <18.0.2
- Fixed in
- 18.0.2
Marked allows Regular Expression Denial of Service (ReDoS) attacks
- Affected
- <0.3.17
- Fixed in
- 0.3.17
Inefficient Regular Expression Complexity in marked
- Affected
- <4.0.10
- Fixed in
- 4.0.10
Inefficient Regular Expression Complexity in marked
- Affected
- <4.0.10
- Fixed in
- 4.0.10
Regular Expression Denial of Service (REDoS) in Marked
- Affected
- >=1.1.1 <2.0.0
- Fixed in
- 2.0.0
Regular Expression Denial of Service in marked
- Affected
- >=0.4.0 <0.7.0
- Fixed in
- 0.7.0
Multiple Content Injection Vulnerabilities in marked
- Affected
- <0.3.1
- Fixed in
- 0.3.1
Marked ReDoS due to email addresses being evaluated in quadratic time
- Affected
- >=0.3.14 <0.6.2
- Fixed in
- 0.6.2
Sanitization bypass using HTML Entities in marked
- Affected
- <0.3.6
- Fixed in
- 0.3.6
Regular Expression Denial of Service in marked
- Affected
- <0.3.9
- Fixed in
- 0.3.9
Marked vulnerable to XSS from data URIs
- Affected
- <0.3.7
- Fixed in
- 0.3.7
Regular Expression Denial of Service in marked
- Affected
- <0.3.4
- Fixed in
- 0.3.4
VBScript Content Injection in marked
- Affected
- <0.3.3
- Fixed in
- 0.3.3
Which of your client projects still run an old marked?
NPMscan reads the package-lock.json, yarn.lock and pnpm-lock.yaml in every GitHub repo you pick and checks each installed version against these advisories, including the packages your packages pull in. Each finding comes with the command that fixes it.
Other npm packages
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily. Package details from the npm registry.