Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Informational severity, with a CVSS score of 0, published 25 February 2021.

Which products and versions are affected?

marked (npm) SEMVER:introduced=0,fixed=0.3.9.

Is there a fix for This vulnerability?

Yes. marked (npm): upgrade to 0.3.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network, in a software library.

Check whether you run marked (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

marked Cross-Site Scripting in HTML entity unescaping

Severity: info · CVSS 0 · Published 2021-02-25

marked is a popular JavaScript library that converts Markdown text into HTML. The library's HTML entity unescaping function failed to recognize uppercase hexadecimal character references (like &#X3a;), allowing attackers to bypass sanitization and inject malicious JavaScript code into generated links. An attacker could craft a Markdown document with specially-formatted character entities that, when rendered by a web application using marked, would execute arbitrary JavaScript in a user's browser.

Technologies: marked (npm). Vendors: npm.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Informational severity, with a CVSS score of 0, published 25 February 2021.
Which products and versions are affected?: marked (npm) SEMVER:introduced=0,fixed=0.3.9.
Is there a fix for This vulnerability?: Yes. marked (npm): upgrade to 0.3.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network, in a software library.
Am I affected?: Check whether you run marked (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

marked (npm): upgrade to 0.3.9 or later
```
npm install marked@0.3.9
```

Technical details

The vulnerability is a Cross-Site Scripting (XSS) issue in the unescape function that processes HTML character entities. The function only recognized lowercase 'x' in hexadecimal entity references (:) but browsers support both lowercase and uppercase (&#X3a;). This case-sensitivity mismatch allowed uppercase variants to pass through sanitization, enabling attackers to inject malicious JavaScript into Markdown URIs. The vulnerability affects marked versions 0.3.7 and earlier when the sanitize option is enabled. An attacker needs only to control Markdown input and have the application render it with marked's sanitization enabled. The fix (commit 6d1901f) adds uppercase 'X' support to the regex pattern matching hexadecimal entities, and the issue was resolved in version 0.3.9.

Affected products

marked marked 0.3.7 and earlier

Timeline

2017-08-15: disclosed: Issue #925 opened on GitHub
2021-02-25: patched: Fix released in version 0.3.9 (commit 6d1901f)
2021-02-25: advisory: GHSA-8wp3-cp9v-44fm published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.