Junglewise Threat Intelligence

CVE-2022-21681: marked Regular Expression Denial of Service in inline.reflinkSearch

CVE-2022-21681 · Severity: low · CVSS 3.1 · Published 2022-01-14

Technologies: Markedjs Marked.

Executive brief

marked is a popular open-source JavaScript markdown parser used to convert markdown text into HTML. The parser contains a regular expression vulnerability in its link reference parsing logic that can be exploited with specially crafted markdown input to consume excessive CPU resources and cause a denial of service. An attacker who can submit untrusted markdown content to an application using marked (without proper resource limits) can hang or crash the service.

Technical details

The vulnerability is a Regular Expression Denial of Service (ReDoS) flaw in the `inline.reflinkSearch` regular expression used by marked for parsing markdown link references. The regex exhibits exponential worst-case computational complexity due to catastrophic backtracking when matching certain malformed input patterns. An attacker can craft markdown containing deeply nested escaped brackets (e.g., `[x]: x \[\](\[\](\[\](...)))`) that triggers the vulnerable backtracking behavior. Exploitation requires no authentication or special privileges; the attacker only needs to supply untrusted markdown to the parser. The attack consumes CPU cycles and can exhaust resources on single-threaded execution contexts. Patches are available in version 4.0.10 and later. Mitigation for unpatched systems includes running marked in a worker thread with a configurable timeout.

Affected products

  • markedjs marked < 4.0.10

Timeline

  • 2022-01-14: disclosed
  • 2022-01-14: patched: Fixed in version 4.0.10

References