Packages / marked / Security

ModerateVulnerabilityGHSA-9cw2-jqp5-7x39CVE-2014-3743Published 31 Aug 2020

Multiple Content Injection Vulnerabilities in marked

Affected · marked

  • < 0.3.1

Fixed in

0.3.1

npm install marked@0.3.1

  1. Affected

    0.0.1 – 0.3.0

    31 releases

  2. Fixed

    0.3.1 – 18.1.1

    194 releases, latest

225 stable releases of marked, oldest to newest.

What happens

Versions 0.3.0 and earlier of marked are affected by two cross-site scripting vulnerabilities, even when sanitize: true is set.

The attack vectors for this vulnerability are GFM Codeblocks and JavaScript URLs.

Recommendation

Upgrade to version 0.3.1 or later.