PT-2019-20081 · Marked · Marked

Published 2019-06-05 · Updated 2019-06-05

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions marked versions 0.3.14 through 0.6.1

Description The issue allows attackers to potentially crash the node process due to resource exhaustion by evaluating email addresses in quadratic time.

Recommendations For marked versions 0.3.14 through 0.6.1, upgrade to version 0.6.2 or later.

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

GHSA-XF5P-87CH-GXW2

Affected Products

Marked

References · 7

• https://osv.dev/vulnerability/GHSA-xf5p-87ch-gxw2 · Vendor Advisory
• https://github.com/markedjs/marked · Note
• https://github.com/markedjs/marked/releases/tag/v0.6.2 · Note
• https://github.com/markedjs/marked/commit/b15e42b67cec9ded8505e9d68bb8741ad7a9590d · Note
• https://github.com/markedjs/marked/pull/1460 · Note
• https://npmjs.com/advisories/812 · Note
• https://snyk.io/vuln/SNYK-JS-MARKED-174116 · Note