Executive brief
The 'marked' library, a popular tool for converting Markdown text into HTML, contains a flaw that allows malicious scripts to be executed in a user's browser. Even when the security 'sanitize' feature is enabled, an attacker can craft a specific link using 'vbscript' that bypasses protections in older versions of Internet Explorer. This could lead to unauthorized actions being performed in the context of the user's session or the theft of sensitive information.
Technical details
A cross-site scripting (XSS) vulnerability exists in the 'marked' npm package versions 0.3.2 and earlier. The vulnerability stems from an incomplete blacklist in the URL sanitization logic within the Renderer.prototype.link function. While the library successfully blocked 'javascript:' URIs, it failed to account for 'vbscript:' URIs, which are executable in certain legacy environments like Internet Explorer 10 (Compatibility View). An attacker can exploit this by providing a Markdown link such as [xss](vbscript:alert(1)), which is rendered into a functional malicious link despite 'sanitize: true' being set. This issue was addressed in version 0.3.3 by adding 'vbscript:' to the protocol blacklist.
Affected products
- markedjs marked <= 0.3.2
Timeline
- 2014-09-25: disclosed: Issue reported on GitHub
- 2014-11-22: patched: Fix committed to repository
- 2020-08-03: advisory: GHSA published (later marked as withdrawn/info)