Executive brief
marked is a popular JavaScript library that converts Markdown text into HTML. The library's HTML entity unescaping function failed to recognize uppercase hexadecimal character references (like :), allowing attackers to bypass sanitization and inject malicious JavaScript code into generated links. An attacker could craft a Markdown document with specially-formatted character entities that, when rendered by a web application using marked, would execute arbitrary JavaScript in a user's browser.
Technical details
The vulnerability is a Cross-Site Scripting (XSS) issue in the unescape function that processes HTML character entities. The function only recognized lowercase 'x' in hexadecimal entity references (:) but browsers support both lowercase and uppercase (:). This case-sensitivity mismatch allowed uppercase variants to pass through sanitization, enabling attackers to inject malicious JavaScript into Markdown URIs. The vulnerability affects marked versions 0.3.7 and earlier when the sanitize option is enabled. An attacker needs only to control Markdown input and have the application render it with marked's sanitization enabled. The fix (commit 6d1901f) adds uppercase 'X' support to the regex pattern matching hexadecimal entities, and the issue was resolved in version 0.3.9.
Affected products
- marked marked 0.3.7 and earlier
Timeline
- 2017-08-15: disclosed: Issue #925 opened on GitHub
- 2021-02-25: patched: Fix released in version 0.3.9 (commit 6d1901f)
- 2021-02-25: advisory: GHSA-8wp3-cp9v-44fm published