# markedjs marked cross-site scripting via vbscript links

Source: https://junglewise.ai/threats/markedjs-marked-cross-site-scripting-via-vbscript-links-8cc442ce  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2020-08-03. Updated: 2026-05-14  
License: CC BY 4.0 with a link back

Severity: info · CVSS 6.1 · Published 2020-08-03

The 'marked' library, a popular tool for converting Markdown text into HTML, contains a flaw that allows malicious scripts to be executed in a user's browser. Even when the security 'sanitize' feature is enabled, an attacker can craft a specific link using 'vbscript' that bypasses protections in older versions of Internet Explorer. This could lead to unauthorized actions being performed in the context of the user's session or the theft of sensitive information.

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Informational severity, with a CVSS score of 6.1, published 3 August 2020.

**Which products and versions are affected?** markedjs marked <= 0.3.2.

**Is there a fix for This vulnerability?** A patch was published on 2014-11-22: Fix committed to repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network, in a software library.

**Am I affected?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A cross-site scripting (XSS) vulnerability exists in the 'marked' npm package versions 0.3.2 and earlier. The vulnerability stems from an incomplete blacklist in the URL sanitization logic within the Renderer.prototype.link function. While the library successfully blocked 'javascript:' URIs, it failed to account for 'vbscript:' URIs, which are executable in certain legacy environments like Internet Explorer 10 (Compatibility View). An attacker can exploit this by providing a Markdown link such as [xss](vbscript:alert(1)), which is rendered into a functional malicious link despite 'sanitize: true' being set. This issue was addressed in version 0.3.3 by adding 'vbscript:' to the protocol blacklist.

## Affected products

- markedjs marked <= 0.3.2

## Timeline

- 2014-09-25: disclosed: Issue reported on GitHub
- 2014-11-22: patched: Fix committed to repository
- 2020-08-03: advisory: GHSA published (later marked as withdrawn/info)

## References

- [https://github.com/markedjs/marked/issues/492](https://github.com/markedjs/marked/issues/492)
- [https://github.com/markedjs/marked/commit/fc372d1c6293267722e33f2719d57cebd67b3da1](https://github.com/markedjs/marked/commit/fc372d1c6293267722e33f2719d57cebd67b3da1)
- [https://www.npmjs.com/advisories/24](https://www.npmjs.com/advisories/24)
- [https://www.npmjs.com/advisories/24/versions](https://www.npmjs.com/advisories/24/versions)