marked (npm)
A markdown parser and compiler. Built for speed.
Advisories
20
Latest version
18.1.2
Released Oct 26, 2026
License
MIT
OpenSSF Scorecard
7.2 / 10
How to fix
Upgrading to 18.0.2 or later clears every advisory below that has a fix.
Upgrade commands
npm
npm install marked@18.1.2yarn
yarn add marked@18.1.2pnpm
pnpm add marked@18.1.2Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-6v9c-7cg6-27q7 Marked Vulnerable to OOM Denial of Service via Infinite Recursion in marked Tokenizer |
High EPSS 0.34% |
>= 18.0.0, <= 18.0.1 | No fix yet |
| GHSA-6v9c-7cg6-27q7 Marked Vulnerable to OOM Denial of Service via Infinite Recursion in marked Tokenizer |
High EPSS 0.34% |
>= 18.0.0, < 18.0.2 | 18.0.2 |
| GHSA-p9wx-2529-fp83 Marked allows Regular Expression Denial of Service (ReDoS) attacks |
Medium EPSS 0.61% |
< 0.3.17 | 0.3.17 |
| GHSA-p9wx-2529-fp83 Marked allows Regular Expression Denial of Service (ReDoS) attacks |
Medium EPSS 0.61% |
< 0.3.17 | 0.3.17 |
| GHSA-5v2h-r2cx-5xgj Inefficient Regular Expression Complexity in marked |
High EPSS 2.77% |
< 4.0.10 | 4.0.10 |
| GHSA-rrrm-qjm4-v8hf Inefficient Regular Expression Complexity in marked |
High EPSS 2.85% |
< 4.0.10 | 4.0.10 |
| GHSA-wjmf-58vc-xqjr Content injection in marked Withdrawn |
Medium | < 0.3.9 | 0.3.9 |
| GHSA-7m7q-q53v-j47v Regular Expression Denial of Service Withdrawn |
Medium | >= 0.5.0, < 0.6.1 | 0.6.1 |
| GHSA-8wp3-cp9v-44fm Cross-Site Scripting in marked Withdrawn |
Medium | < 0.3.9 | 0.3.9 |
| GHSA-4r62-v4vq-hr96 Regular Expression Denial of Service (REDoS) in Marked |
High EPSS 2.46% |
>= 1.1.1, < 2.0.0 | 2.0.0 |
| GHSA-ch52-vgq2-943f Regular Expression Denial of Service in marked |
Low | >= 0.4.0, < 0.7.0 | 0.7.0 |
| GHSA-9cw2-jqp5-7x39 Multiple Content Injection Vulnerabilities in marked |
Medium EPSS 1.71% |
< 0.3.1 | 0.3.1 |
| GHSA-32vw-r77c-gm67 Withdrawn Advisory: marked cross-site scripting vulnerability Withdrawn |
Medium | < 0.3.3 | 0.3.3 |
| GHSA-xf5p-87ch-gxw2 Marked ReDoS due to email addresses being evaluated in quadratic time |
Medium | >= 0.3.14, < 0.6.2 | 0.6.2 |
| GHSA-vfvf-mqq8-rwqc Sanitization bypass using HTML Entities in marked |
Medium EPSS 1.44% |
< 0.3.6 | 0.3.6 |
| GHSA-x5pg-88wf-qq4p Regular Expression Denial of Service in marked |
High EPSS 1.73% |
< 0.3.9 | 0.3.9 |
| GHSA-7px7-7xjx-hxm8 Marked vulnerable to XSS from data URIs |
Medium EPSS 1.51% |
< 0.3.7 | 0.3.7 |
| GHSA-crmx-v835-hcp4 Moderate severity vulnerability that affects marked Withdrawn |
Medium | < 0.3.9 | 0.3.9 |
| GHSA-cfjh-p3g4-3q2f VBScript Content Injection in marked |
Medium EPSS 2.04% |
< 0.3.3 | 0.3.3 |
| GHSA-hjcp-j389-59ff Regular Expression Denial of Service in marked |
High EPSS 4.42% |
< 0.3.4 | 0.3.4 |
Source: git+https://github.com/markedjs/marked.git
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor