Approved changes feed: RSS · Atom
cpe:2.3:a:markedjs:marked:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Markedjs (513520e6-e110-54a6-8344-7f7882818185) |
|---|---|
| Product | Marked (6cd8f4bf-38fe-5a85-a46d-74ab2fed3be1) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-41680 |
vulnerable | 2026-06-08 08:03:15.685829 |
Marked: OOM Denial of Service via Infinite Recursion in marked Tokenizer
Marked is a markdown parser and compiler. From 18.0.0 to 18.0.1, a critical Denial of Service (DoS) vulnerability exists in marked. By providing a specific 3-byte input sequence a tab, a vertical tab, and a newline (\x09\x0b\n)—an unauthenticated attacker can trigger an infinite recursion loop during parsing. This leads to unbounded memory allocation, causing the host Node.js application to crash via Memory Exhaustion (OOM). This vulnerability is fixed in 18.0.2.
Published: 2026-04-24T17:26:27.847Z
Updated: 2026-04-24T19:08:41.300Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-21681 |
vulnerable | 2026-06-08 05:40:01.990070 |
Exponential catastrophic backtracking (ReDoS) in marked
HIGH (7.5)
Marked is a markdown parser and compiler. Prior to version 4.0.10, the regular expression `inline.reflinkSearch` may cause catastrophic backtracking against some strings and lead to a denial of service (DoS). Anyone who runs untrusted markdown through a vulnerable version of marked and does not use a worker with a time limit may be affected. This issue is patched in version 4.0.10. As a workaround, avoid running untrusted markdown through marked or run marked on a worker thread and set a reasonable time limit to prevent draining resources.
Published: 2022-01-14T00:00:00.000Z
Updated: 2025-04-22T18:33:29.916Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-21680 |
vulnerable | 2026-06-08 05:40:01.988515 |
Cubic catastrophic backtracking (ReDoS) in marked
HIGH (7.5)
Marked is a markdown parser and compiler. Prior to version 4.0.10, the regular expression `block.def` may cause catastrophic backtracking against some strings and lead to a regular expression denial of service (ReDoS). Anyone who runs untrusted markdown through a vulnerable version of marked and does not use a worker with a time limit may be affected. This issue is patched in version 4.0.10. As a workaround, avoid running untrusted markdown through marked or run marked on a worker thread and set a reasonable time limit to prevent draining resources.
Published: 2022-01-14T00:00:00.000Z
Updated: 2025-04-22T18:33:37.402Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-21306 |
vulnerable | 2026-06-08 05:29:11.586388 |
Denial of Service in Marked
MEDIUM (5.3)
Marked is an open-source markdown parser and compiler (npm package "marked"). In marked from version 1.1.1 and before version 2.0.0, there is a Regular expression Denial of Service vulnerability. This vulnerability can affect anyone who runs user generated code through marked. This vulnerability is fixed in version 2.0.0.
Published: 2021-02-08T21:20:18.000Z
Updated: 2024-08-03T18:09:15.882Z Reference links |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.