Quick answers
- Is CVE-2018-25110 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2018-25110 being exploited in the wild.
- How severe is CVE-2018-25110?
- Medium severity, with a CVSS score of 4, published 23 May 2025.
- Which products and versions are affected?
- marked (npm) SEMVER:introduced=0,fixed=0.3.17.
- Is there a fix for CVE-2018-25110?
- Yes. marked (npm): upgrade to 0.3.17 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2018-25110 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2018-25110?
- Check whether you run marked (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- marked (npm): upgrade to 0.3.17 or later
npm install marked@0.3.17
Technical details
The vulnerability involves Regular Expression Denial of Service (ReDoS) attacks exploiting catastrophic backtracking in multiple regex patterns used for parsing HTML tags and markdown links. The vulnerable patterns, found in lib/marked.js, include expressions for link parsing (with exponential blow-up) and HTML tag attribute parsing (with power-law blow-up). An attacker with the ability to submit markdown input can trigger these regexes with specially crafted payloads such as deeply nested brackets or repetitively structured tag attributes. No authentication is required; the vulnerability is reachable directly through any input that is parsed by Marked. An attacker can achieve denial of service by blocking the JavaScript event loop for extended periods. The vulnerability is fixed in version 0.3.17 and later.
Affected products
- Marked Marked prior to 0.3.17
Identifiers
- CVE-2018-25110
- GHSA-p9wx-2529-fp83
Timeline
- 2025-05-23: disclosed
- 2025-05-27: advisory