Executive brief
marked is a popular JavaScript library used to parse and render Markdown content into HTML. Versions 0.3.0 and earlier contain cross-site scripting (XSS) vulnerabilities that allow attackers to inject malicious scripts into rendered content even when sanitization is enabled. This could enable attackers to steal user data, hijack sessions, or deface pages that use vulnerable versions of the library.
Technical details
marked versions ≤0.3.0 are vulnerable to cross-site scripting (CWE-79) through two attack vectors: GFM (GitHub Flavored Markdown) codeblocks and JavaScript URLs. The vulnerability persists even when the sanitize option is set to true, indicating a bypass in the sanitization logic. An attacker can craft malicious Markdown input containing embedded JavaScript that executes in the browser context of users viewing the rendered content. The vulnerability requires user interaction (the user must view rendered content) but has a network attack vector since Markdown can be delivered remotely. The fix is available in version 0.3.1 and later.
Affected products
- marked marked 0.3.0 and earlier
Timeline
- 2020-08-31: disclosed
- 2014: patched: CVE-2014-3743 filed in 2014; fix released in version 0.3.1