Is CVE-2021-21306 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2021-21306 being exploited in the wild.

How severe is CVE-2021-21306?

Low severity, with a CVSS score of 3.1, published 8 February 2021.

Which products and versions are affected?

marked (npm) SEMVER:introduced=1.1.1,fixed=2.0.0.

Is there a fix for CVE-2021-21306?

Yes. marked (npm): upgrade to 2.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2021-21306 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2021-21306?

Check whether you run marked (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2021-21306: Marked regular expression denial of service

CVE-2021-21306 · Severity: low · CVSS 3.1 · Published 2021-02-08

Marked is a widely-used JavaScript library for converting markdown text to HTML. A denial of service vulnerability exists in how the library processes emphasis and strong text formatting when user-supplied input contains specific underscore patterns. An attacker can craft markdown input that causes the parser to hang or consume excessive system resources, potentially disrupting services that accept user-generated markdown content. The vulnerability has been patched in version 2.0.0.

Technologies: marked (npm). Vendors: npm.

Quick answers

Is CVE-2021-21306 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2021-21306 being exploited in the wild.
How severe is CVE-2021-21306?: Low severity, with a CVSS score of 3.1, published 8 February 2021.
Which products and versions are affected?: marked (npm) SEMVER:introduced=1.1.1,fixed=2.0.0.
Is there a fix for CVE-2021-21306?: Yes. marked (npm): upgrade to 2.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2021-21306 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2021-21306?: Check whether you run marked (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

marked (npm): upgrade to 2.0.0 or later
```
npm install marked@2.0.0
```

Technical details

The vulnerability is a Regular Expression Denial of Service (ReDoS) triggered by catastrophic backtracking in the regex patterns used for emphasis (em) and strong text processing. The root cause is in how the tokenizer handles groups of consecutive underscores using vulnerable regex patterns that suffer from exponential backtracking on certain input patterns. An attacker can send specially crafted markdown containing sequences of underscores that trigger this behavior without requiring authentication or special privileges. The attack vector is network-based and affects any code path that processes untrusted markdown input. The vulnerability was fixed in version 2.0.0 (released February 2021) by completely reworking the emphasis/strong tokenizer to use a more efficient parsing strategy that avoids catastrophic backtracking. No workarounds are available for affected versions; upgrade is required.

Affected products

markedjs marked >=1.1.1, <2.0.0

Identifiers

CVE-2021-21306
GHSA-4r62-v4vq-hr96

Timeline

2021-02-08: disclosed: Vulnerability disclosed (GHSA-4r62-v4vq-hr96)
2021-02-08: patched: Fixed in version 2.0.0 (commit 7293251)

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.