GHSA-ch52-vgq2-943f

Regular Expression Denial of Service in marked

Low npm

Severity: Low; The publisher's own rating, not a CVSS score
Exploit chance (EPSS): —; No score published
Known exploited: No; Not in CISA's catalog
Weakness: CWE-1333 Inefficient Regular Expression Complexity
Fix: 0.7.0; Upgrade marked to this version or later

Description

Affected versions of marked are vulnerable to Regular Expression Denial of Service (ReDoS). The _label subrule may significantly degrade parsing performance of malformed input.

Recommendation

Upgrade to version 0.7.0 or later.

Affected versions

npm

Package	Vulnerable	Fixed in
marked	`>= 0.4.0, < 0.7.0`	`0.7.0`

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

marked npm → `0.7.0`

npm

npm install marked@0.7.0

yarn

yarn add marked@0.7.0

pnpm

pnpm add marked@0.7.0

Weakness

CWE-1333: Inefficient Regular Expression Complexity

The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.

How to prevent it

Architecture and Design: Use regular expressions that do not support backtracking, e.g. by removing nested quantifiers.
System Configuration: Set backtracking limits in the configuration of the regular expression implementation, such as PHP's pcre.backtrack_limit. Also consider limits on execution time for the process.
Implementation: Do not use regular expressions with untrusted input. If regular expressions must be used, avoid using backtracking in the expression.
Implementation: Limit the length of the input that the regular expression will process.

References

Timeline

Aug 31, 2020 Last updated by the source
Sep 3, 2020 Published

Advisory	Severity	Why it's related
GHSA-6v9c-7cg6-27q7 Marked Vulnerable to OOM Denial of Service via Infinite Recursion in marked Tokenizer	High	Also affects marked
GHSA-p9wx-2529-fp83 Marked allows Regular Expression Denial of Service (ReDoS) attacks	Medium	Also affects marked
GHSA-5v2h-r2cx-5xgj Inefficient Regular Expression Complexity in marked	High	Also affects marked
GHSA-rrrm-qjm4-v8hf Inefficient Regular Expression Complexity in marked	High	Also affects marked
GHSA-4r62-v4vq-hr96 Regular Expression Denial of Service (REDoS) in Marked	High	Also affects marked
GHSA-9cw2-jqp5-7x39 Multiple Content Injection Vulnerabilities in marked	Medium	Also affects marked
GHSA-xf5p-87ch-gxw2 Marked ReDoS due to email addresses being evaluated in quadratic time	Medium	Also affects marked
GHSA-vfvf-mqq8-rwqc Sanitization bypass using HTML Entities in marked	Medium	Also affects marked

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor