Executive brief
Marked is a widely-used JavaScript library for converting markdown text to HTML. A denial of service vulnerability exists in how the library processes emphasis and strong text formatting when user-supplied input contains specific underscore patterns. An attacker can craft markdown input that causes the parser to hang or consume excessive system resources, potentially disrupting services that accept user-generated markdown content. The vulnerability has been patched in version 2.0.0.
Technical details
The vulnerability is a Regular Expression Denial of Service (ReDoS) triggered by catastrophic backtracking in the regex patterns used for emphasis (em) and strong text processing. The root cause is in how the tokenizer handles groups of consecutive underscores using vulnerable regex patterns that suffer from exponential backtracking on certain input patterns. An attacker can send specially crafted markdown containing sequences of underscores that trigger this behavior without requiring authentication or special privileges. The attack vector is network-based and affects any code path that processes untrusted markdown input. The vulnerability was fixed in version 2.0.0 (released February 2021) by completely reworking the emphasis/strong tokenizer to use a more efficient parsing strategy that avoids catastrophic backtracking. No workarounds are available for affected versions; upgrade is required.
Affected products
- markedjs marked >=1.1.1, <2.0.0
Timeline
- 2021-02-08: disclosed: Vulnerability disclosed (GHSA-4r62-v4vq-hr96)
- 2021-02-08: patched: Fixed in version 2.0.0 (commit 7293251)