Executive brief
marked is a popular JavaScript markdown parser used in many web applications to convert markdown text to HTML. When the sanitize option is enabled (intended to prevent malicious content), attackers can bypass this protection by embedding HTML entities in link URLs to inject executable JavaScript. A user viewing a crafted markdown document could have malicious scripts execute in their browser without their knowledge.
Technical details
The vulnerability is a cross-site scripting (XSS) bypass in marked's sanitization logic, affecting versions prior to 0.3.6. The root cause is improper handling of HTML entities in link URIs: the parser attempts to decode HTML entities using a regex pattern that fails to correctly validate the full entity, while browsers apply more lenient parsing rules that allow incomplete entities to resolve partially. For example, the payload `javascript&#x58document;alert(1)` bypasses the regex check but renders as a valid `javascript:` URL in the browser. This requires user interaction (clicking the link) and only affects applications with sanitize:true enabled. The fix is to update to version 0.3.6 or later, which properly validates and handles HTML entities.
Affected products
- chjj marked before 0.3.6
Timeline
- 2015-05-19: disclosed: Vulnerability reported in GitHub issue
- 2016-07-29: patched: Fixed in PR #592, merged to master
- 2019-02-18: advisory: GHSA-vfvf-mqq8-rwqc published
- 2016: other: CVE-2016-10531 assigned