TI-2026-30197 CVE-2026-41680 · GHSA-6v9c-7cg6-27q7
Marked: OOM Denial of Service via Infinite Recursion in marked Tokenizer
Priority HIGH 77
Marked is a markdown parser and compiler.
markedjs
Records11All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high6CVSS 7.0–8.9
Exploited now
markedjs records in CISA KEVNo markedjs vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
11 records in Marked · all components
TI-2022-06057 CVE-2022-21681 · GHSA-5v2h-r2cx-5xgj
Exponential catastrophic backtracking (ReDoS) in marked
Priority HIGH 72
Marked is a markdown parser and compiler.
TI-2022-06056 CVE-2022-21680 · GHSA-rrrm-qjm4-v8hf
Cubic catastrophic backtracking (ReDoS) in marked
Priority HIGH 72
Marked is a markdown parser and compiler.
TI-2018-15336 CVE-2018-25110 · GHSA-p9wx-2529-fp83
Regular Expression Denial of Service (ReDoS) in markedjs/marked
Priority HIGH 70
Marked prior to version 0.3.17 is vulnerable to a Regular Expression Denial of Service (ReDoS) attack due to catastrophic backtracking in several regular expressions used for parsing HTML tags and markdown links.
TI-2015-07284 CVE-2015-8854 · GHSA-hjcp-j389-59ff
The marked package before 0.3.4 for Node.js allows attackers to cause a denial of service…
Priority MEDIUM 40
The marked package before 0.3.4 for Node.js allows attackers to cause a denial of service (CPU consumption) via unspecified vectors that trigger a "catastrophic backtracking issue for the em inline rule," aka a "regular…
TI-2021-04406 CVE-2021-21306 · GHSA-4r62-v4vq-hr96
Denial of Service in Marked
Priority LOW 38
Marked is an open-source markdown parser and compiler (npm package "marked").
TI-2017-11833 CVE-2017-16114 · GHSA-x5pg-88wf-qq4p
Uncontrolled resource consumption in HackerOne marked node module
Priority LOW 36
The marked module is vulnerable to a regular expression denial of service.
TI-2014-03042 CVE-2014-3743 · GHSA-9cw2-jqp5-7x39
Multiple cross-site scripting (XSS) vulnerabilities in the Marked module before 0.3.1 for…
Priority LOW 31
Multiple cross-site scripting (XSS) vulnerabilities in the Marked module before 0.3.1 for Node.js allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) gfm codeblocks (language) or (2)…
TI-2017-14646 CVE-2017-1000427 · GHSA-7px7-7xjx-hxm8
marked version 0.3.6 and earlier is vulnerable to an XSS attack in the data: URI parser.
Priority LOW 30
marked version 0.3.6 and earlier is vulnerable to an XSS attack in the data: URI parser.
TI-2016-08573 CVE-2016-10531 · GHSA-vfvf-mqq8-rwqc
Cross-site scripting in HackerOne marked node module
Priority LOW 30
marked is an application that is meant to parse and compile markdown.
TI-2015-01247 CVE-2015-1370 · GHSA-cfjh-p3g4-3q2f
Incomplete blacklist vulnerability in marked 0.3.2 and earlier for Node.js allows remote…
Priority LOW 24
Incomplete blacklist vulnerability in marked 0.3.2 and earlier for Node.js allows remote attackers to conduct cross-site scripting (XSS) attacks via a vbscript tag in a link.