TI-2026-30197 CVE-2026-41680 · GHSA-6v9c-7cg6-27q7
Marked: OOM Denial of Service via Infinite Recursion in marked Tokenizer
Priority HIGH 77
Marked is a markdown parser and compiler.
Vulnerabilities
11 records
TI-2018-15336 CVE-2018-25110 · GHSA-p9wx-2529-fp83
Regular Expression Denial of Service (ReDoS) in markedjs/marked
Priority HIGH 70
Marked prior to version 0.3.17 is vulnerable to a Regular Expression Denial of Service (ReDoS) attack due to catastrophic backtracking in several regular expressions used for parsing HTML tags and markdown links.
TI-2022-06057 CVE-2022-21681 · GHSA-5v2h-r2cx-5xgj
Exponential catastrophic backtracking (ReDoS) in marked
Priority HIGH 72
Marked is a markdown parser and compiler.
TI-2022-06056 CVE-2022-21680 · GHSA-rrrm-qjm4-v8hf
Cubic catastrophic backtracking (ReDoS) in marked
Priority HIGH 72
Marked is a markdown parser and compiler.
TI-2021-04406 CVE-2021-21306 · GHSA-4r62-v4vq-hr96
Denial of Service in Marked
Priority LOW 38
Marked is an open-source markdown parser and compiler (npm package "marked").
TI-2014-03042 CVE-2014-3743 · GHSA-9cw2-jqp5-7x39
Multiple cross-site scripting (XSS) vulnerabilities in the Marked module before 0.3.1 for…
Priority LOW 31
Multiple cross-site scripting (XSS) vulnerabilities in the Marked module before 0.3.1 for Node.js allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) gfm codeblocks (language) or (2)…
TI-2017-11833 CVE-2017-16114 · GHSA-x5pg-88wf-qq4p
Uncontrolled resource consumption in HackerOne marked node module
Priority LOW 36
The marked module is vulnerable to a regular expression denial of service.
TI-2016-08573 CVE-2016-10531 · GHSA-vfvf-mqq8-rwqc
Cross-site scripting in HackerOne marked node module
Priority LOW 30
marked is an application that is meant to parse and compile markdown.
TI-2017-14646 CVE-2017-1000427 · GHSA-7px7-7xjx-hxm8
marked version 0.3.6 and earlier is vulnerable to an XSS attack in the data: URI parser.
Priority LOW 30
marked version 0.3.6 and earlier is vulnerable to an XSS attack in the data: URI parser.
TI-2015-07284 CVE-2015-8854 · GHSA-hjcp-j389-59ff
The marked package before 0.3.4 for Node.js allows attackers to cause a denial of service…
Priority MEDIUM 40
The marked package before 0.3.4 for Node.js allows attackers to cause a denial of service (CPU consumption) via unspecified vectors that trigger a "catastrophic backtracking issue for the em inline rule," aka a "regular…
TI-2015-01247 CVE-2015-1370 · GHSA-cfjh-p3g4-3q2f
Incomplete blacklist vulnerability in marked 0.3.2 and earlier for Node.js allows remote…
Priority LOW 24
Incomplete blacklist vulnerability in marked 0.3.2 and earlier for Node.js allows remote attackers to conduct cross-site scripting (XSS) attacks via a vbscript tag in a link.