Is CVE-2022-21681 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2022-21681 being exploited in the wild.

How severe is CVE-2022-21681?

Low severity, with a CVSS score of 3.1, published 14 January 2022.

Which products and versions are affected?

marked (npm) SEMVER:introduced=0,fixed=4.0.10.

Is there a fix for CVE-2022-21681?

Yes. marked (npm): upgrade to 4.0.10 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2022-21681 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2022-21681?

Check whether you run marked (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2022-21681: marked Regular Expression Denial of Service in inline.reflinkSearch

CVE-2022-21681 · Severity: low · CVSS 3.1 · Published 2022-01-14

marked is a popular open-source JavaScript markdown parser used to convert markdown text into HTML. The parser contains a regular expression vulnerability in its link reference parsing logic that can be exploited with specially crafted markdown input to consume excessive CPU resources and cause a denial of service. An attacker who can submit untrusted markdown content to an application using marked (without proper resource limits) can hang or crash the service.

Technologies: marked (npm). Vendors: npm.

Quick answers

Is CVE-2022-21681 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2022-21681 being exploited in the wild.
How severe is CVE-2022-21681?: Low severity, with a CVSS score of 3.1, published 14 January 2022.
Which products and versions are affected?: marked (npm) SEMVER:introduced=0,fixed=4.0.10.
Is there a fix for CVE-2022-21681?: Yes. marked (npm): upgrade to 4.0.10 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2022-21681 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2022-21681?: Check whether you run marked (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

marked (npm): upgrade to 4.0.10 or later
```
npm install marked@4.0.10
```

Technical details

The vulnerability is a Regular Expression Denial of Service (ReDoS) flaw in the `inline.reflinkSearch` regular expression used by marked for parsing markdown link references. The regex exhibits exponential worst-case computational complexity due to catastrophic backtracking when matching certain malformed input patterns. An attacker can craft markdown containing deeply nested escaped brackets (e.g., `[x]: x \[\](\[\](\[\](...)))`) that triggers the vulnerable backtracking behavior. Exploitation requires no authentication or special privileges; the attacker only needs to supply untrusted markdown to the parser. The attack consumes CPU cycles and can exhaust resources on single-threaded execution contexts. Patches are available in version 4.0.10 and later. Mitigation for unpatched systems includes running marked in a worker thread with a configurable timeout.

Affected products

markedjs marked < 4.0.10

Identifiers

CVE-2022-21681
GHSA-5v2h-r2cx-5xgj

Timeline

2022-01-14: disclosed
2022-01-14: patched: Fixed in version 4.0.10

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.