Executive brief
Marked is a popular JavaScript markdown parser library used to convert markdown text into HTML. Versions before 0.3.17 contain multiple regular expressions that are vulnerable to catastrophic backtracking, allowing an attacker to craft specially formatted markdown input that causes the parser to hang and consume excessive CPU resources, effectively disabling any service that processes untrusted markdown content.
Technical details
The vulnerability involves Regular Expression Denial of Service (ReDoS) attacks exploiting catastrophic backtracking in multiple regex patterns used for parsing HTML tags and markdown links. The vulnerable patterns, found in lib/marked.js, include expressions for link parsing (with exponential blow-up) and HTML tag attribute parsing (with power-law blow-up). An attacker with the ability to submit markdown input can trigger these regexes with specially crafted payloads such as deeply nested brackets or repetitively structured tag attributes. No authentication is required; the vulnerability is reachable directly through any input that is parsed by Marked. An attacker can achieve denial of service by blocking the JavaScript event loop for extended periods. The vulnerability is fixed in version 0.3.17 and later.
Affected products
- Marked Marked prior to 0.3.17
Timeline
- 2025-05-23: disclosed
- 2025-05-27: advisory