Is CVE-2014-3743 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2014-3743 being exploited in the wild.

How severe is CVE-2014-3743?

Low severity, with a CVSS score of 3.1, published 31 August 2020.

Which products and versions are affected?

marked (npm) SEMVER:introduced=0,fixed=0.3.1.

Is there a fix for CVE-2014-3743?

Yes. marked (npm): upgrade to 0.3.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2014-3743 attacked?

It is attacked over the network.

Am I affected by CVE-2014-3743?

Check whether you run marked (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2014-3743: marked content injection via GFM codeblocks and JavaScript URLs

CVE-2014-3743 · Severity: low · CVSS 3.1 · Published 2020-08-31

marked is a popular JavaScript library used to parse and render Markdown content into HTML. Versions 0.3.0 and earlier contain cross-site scripting (XSS) vulnerabilities that allow attackers to inject malicious scripts into rendered content even when sanitization is enabled. This could enable attackers to steal user data, hijack sessions, or deface pages that use vulnerable versions of the library.

Technologies: marked (npm). Vendors: npm.

Quick answers

Is CVE-2014-3743 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2014-3743 being exploited in the wild.
How severe is CVE-2014-3743?: Low severity, with a CVSS score of 3.1, published 31 August 2020.
Which products and versions are affected?: marked (npm) SEMVER:introduced=0,fixed=0.3.1.
Is there a fix for CVE-2014-3743?: Yes. marked (npm): upgrade to 0.3.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2014-3743 attacked?: It is attacked over the network.
Am I affected by CVE-2014-3743?: Check whether you run marked (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

marked (npm): upgrade to 0.3.1 or later
```
npm install marked@0.3.1
```

Technical details

marked versions ≤0.3.0 are vulnerable to cross-site scripting (CWE-79) through two attack vectors: GFM (GitHub Flavored Markdown) codeblocks and JavaScript URLs. The vulnerability persists even when the sanitize option is set to true, indicating a bypass in the sanitization logic. An attacker can craft malicious Markdown input containing embedded JavaScript that executes in the browser context of users viewing the rendered content. The vulnerability requires user interaction (the user must view rendered content) but has a network attack vector since Markdown can be delivered remotely. The fix is available in version 0.3.1 and later.

Affected products

marked marked 0.3.0 and earlier

Identifiers

CVE-2014-3743
GHSA-9cw2-jqp5-7x39

Timeline

2020-08-31: disclosed
2014: patched: CVE-2014-3743 filed in 2014; fix released in version 0.3.1

References

https://www.npmjs.com/advisories/22

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.