Is CVE-2016-10531 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2016-10531 being exploited in the wild.

How severe is CVE-2016-10531?

Low severity, with a CVSS score of 3, published 18 February 2019.

Which products and versions are affected?

marked (npm) SEMVER:introduced=0,fixed=0.3.6.

Is there a fix for CVE-2016-10531?

Yes. marked (npm): upgrade to 0.3.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2016-10531 attacked?

It is attacked over the network.

Am I affected by CVE-2016-10531?

Check whether you run marked (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2016-10531: marked sanitization bypass using HTML entities

CVE-2016-10531 · Severity: low · CVSS 3 · Published 2019-02-18

marked is a popular JavaScript markdown parser used in many web applications to convert markdown text to HTML. When the sanitize option is enabled (intended to prevent malicious content), attackers can bypass this protection by embedding HTML entities in link URLs to inject executable JavaScript. A user viewing a crafted markdown document could have malicious scripts execute in their browser without their knowledge.

Technologies: marked (npm). Vendors: npm.

Quick answers

Is CVE-2016-10531 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2016-10531 being exploited in the wild.
How severe is CVE-2016-10531?: Low severity, with a CVSS score of 3, published 18 February 2019.
Which products and versions are affected?: marked (npm) SEMVER:introduced=0,fixed=0.3.6.
Is there a fix for CVE-2016-10531?: Yes. marked (npm): upgrade to 0.3.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2016-10531 attacked?: It is attacked over the network.
Am I affected by CVE-2016-10531?: Check whether you run marked (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

marked (npm): upgrade to 0.3.6 or later
```
npm install marked@0.3.6
```

Technical details

The vulnerability is a cross-site scripting (XSS) bypass in marked's sanitization logic, affecting versions prior to 0.3.6. The root cause is improper handling of HTML entities in link URIs: the parser attempts to decode HTML entities using a regex pattern that fails to correctly validate the full entity, while browsers apply more lenient parsing rules that allow incomplete entities to resolve partially. For example, the payload `javascript&#x58document;alert&#40;1&#41;` bypasses the regex check but renders as a valid `javascript:` URL in the browser. This requires user interaction (clicking the link) and only affects applications with sanitize:true enabled. The fix is to update to version 0.3.6 or later, which properly validates and handles HTML entities.

Affected products

chjj marked before 0.3.6

Identifiers

CVE-2016-10531
GHSA-vfvf-mqq8-rwqc

Timeline

2015-05-19: disclosed: Vulnerability reported in GitHub issue
2016-07-29: patched: Fixed in PR #592, merged to master
2019-02-18: advisory: GHSA-vfvf-mqq8-rwqc published
2016: other: CVE-2016-10531 assigned

References

https://github.com/chjj/marked/pull/592

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.