Executive brief
marked is a popular JavaScript library used to convert Markdown text into HTML. A regular expression denial-of-service (ReDoS) flaw in earlier versions could allow an attacker to crash servers or applications by submitting specially crafted Markdown strings, causing performance degradation or service unavailability. However, this advisory was withdrawn in 2021 after further investigation determined it was not actually a security issue.
Technical details
The vulnerability was reported as a ReDoS flaw in the marked.js file, where maliciously crafted input could trigger excessive regular expression backtracking and cause denial of service. The issue affected marked versions prior to 0.3.9, with a patch released in version 0.3.9. The advisory was withdrawn on December 2, 2021, per the NVD's determination that "further investigation showed that it was not a security issue," indicating the reported ReDoS condition was either not reproducible or not actually exploitable in practice.
Affected products
- marked marked < 0.3.9
Timeline
- 2018-01-04: disclosed
- 2018: patched: patch released in version 0.3.9
- 2021-12-02: other: advisory withdrawn; further investigation showed it was not a security issue