Executive brief
marked is a JavaScript library for converting Markdown to HTML. When mangling is disabled, the library fails to escape URLs in autolinks, allowing attackers to inject arbitrary HTML event handlers (such as onclick) into generated links. This can lead to cross-site scripting (XSS) attacks when user-supplied Markdown is rendered.
Technical details
The vulnerability is an XSS injection in marked's autolink handling when the `mangle` option is set to false. The root cause is insufficient escaping of href attributes in generated anchor tags. When processing email autolinks (e.g., `<user@example.com>`), if mangling is disabled, the library does not properly escape special characters in the href target, allowing an attacker to break out of the href attribute and inject arbitrary HTML event handlers. The attack requires the attacker to control the Markdown input and the application to have mangling disabled. The fix escapes non-mangled hrefs to prevent the injection. Affected versions: 0.3.7 and earlier; fixed in 0.3.9.
Affected products
- marked marked 0.3.7 and earlier
Timeline
- 2017-08-15: disclosed: Issue #926 filed on GitHub
- 2019-06-05: patched: Reviewed and fixed in commit cb72584
- 2021-02-25: advisory: GHSA published