Executive brief
marked is a JavaScript markdown parser used by thousands of applications to convert markdown text into HTML. An attacker can craft a malicious markdown string that causes the parser to hang or consume excessive CPU resources, effectively denying service to legitimate users. This can impact any application that processes untrusted markdown without resource limits.
Technical details
A Regular Expression Denial of Service (ReDoS) vulnerability exists in the block.def regular expression used by marked's markdown parsing engine. The regex exhibits cubic catastrophic backtracking when processing specially crafted input strings containing repeated whitespace, causing exponential computational complexity. The vulnerability is triggered when untrusted markdown is parsed without safeguards; a proof-of-concept payload with 1500 repeated spaces triggers excessive CPU consumption. No authentication or user interaction is required—an attacker needs only the ability to submit markdown for parsing. The issue has been patched in version 4.0.10; workarounds include running marked on a worker thread with a time limit or avoiding parsing of untrusted markdown.
Affected products
- markedjs marked before 4.0.10
Timeline
- 2022-01-14: disclosed
- 2022-01-14: patched: version 4.0.10 released