Executive brief
marked is a widely-used JavaScript library for converting Markdown to HTML. Versions 0.3.2 and earlier contain a cross-site scripting (XSS) vulnerability that allows attackers to inject malicious VBScript code into links, even when the library's sanitization feature is enabled. An attacker could use this to steal user credentials, redirect users to malicious sites, or perform actions on behalf of affected users.
Technical details
The vulnerability is a cross-site scripting (CWE-79) flaw in marked's link sanitization logic. Affected versions 0.3.2 and earlier fail to properly strip or escape VBScript protocol handlers (vbscript:) in href attributes even when the sanitize option is set to true. An attacker can craft Markdown input containing [text](vbscript:alert(1)) which renders as a malicious link. The attack is browser-specific, most reliably exploitable in IE10 Compatibility Mode and potentially other Internet Explorer versions. The fix was released in version 0.3.3.
Affected products
- marked marked 0.3.2 and earlier
Timeline
- 2015-01: disclosed: Vulnerability reported and fixed in marked 0.3.3
- 2017-10-24: advisory: GHSA-cfjh-p3g4-3q2f published