Packages / marked / Security

ModerateVulnerabilityGHSA-7px7-7xjx-hxm8CVE-2017-1000427Published 4 Jan 2018

Marked vulnerable to XSS from data URIs

Affected · marked

  • < 0.3.7

Fixed in

0.3.7

npm install marked@0.3.7

  1. Affected

    0.0.1 – 0.3.6

    37 releases

  2. Fixed

    0.3.7 – 18.1.1

    188 releases, latest

225 stable releases of marked, oldest to newest.

What happens

marked version 0.3.6 and earlier is vulnerable to an XSS attack in the data: URI parser.