CVE-2016-10531
published 2018-05-31CVE-2016-10531: marked is an application that is meant to parse and compile markdown. Due to the way that marked 0.3.5 and earlier parses input, specifically HTML entities…
PriorityP426medium6.1CVSS 3.0
AVNACLPRNUIRSCCLILAN
EPSS
1.46%
70.7th percentile
marked is an application that is meant to parse and compile markdown. Due to the way that marked 0.3.5 and earlier parses input, specifically HTML entities, it's possible to bypass marked's content injection protection (`sanitize: true`) to inject a `javascript:` URL. This flaw exists because `&#xNNanything;` gets parsed to what it could and leaves the rest behind, resulting in just `anything;` being left.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | node-marked | < node-marked 0.3.6+dfsg-1 (bookworm) | node-marked 0.3.6+dfsg-1 (bookworm) |
| hackerone | marked_node_module | — | — |
| marked_project | marked | <= 0.3.5 | — |
| marked_project | marked | >= 0 < 0.3.6 | 0.3.6 |
CVSS provenance
nvdv3.06.1MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
osv6.1MEDIUM
vendor_debian6.1LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Sanitization bypass using HTML Entities in marked
osv·2019-02-18
CVE-2016-10531 [MEDIUM] Sanitization bypass using HTML Entities in marked
Sanitization bypass using HTML Entities in marked
Affected versions of `marked` are susceptible to a cross-site scripting vulnerability in link components when `sanitize:true` is configured.
## Proof of Concept
This flaw exists because link URIs containing HTML entities get processed in an abnormal manner. Any HTML Entities get parsed on a best-effort basis and included in the resulting link, while if that parsing fails that character is omitted.
For example:
A link URI such as
```
javascript֍ocument;alert(1)
```
Renders a valid link that when clicked will execute `alert(1)`.
## Recommendation
Update to version 0.3.6 or later.
GHSA
Sanitization bypass using HTML Entities in marked
ghsa·2019-02-18
CVE-2016-10531 [MEDIUM] CWE-79 Sanitization bypass using HTML Entities in marked
Sanitization bypass using HTML Entities in marked
Affected versions of `marked` are susceptible to a cross-site scripting vulnerability in link components when `sanitize:true` is configured.
## Proof of Concept
This flaw exists because link URIs containing HTML entities get processed in an abnormal manner. Any HTML Entities get parsed on a best-effort basis and included in the resulting link, while if that parsing fails that character is omitted.
For example:
A link URI such as
```
javascript֍ocument;alert(1)
```
Renders a valid link that when clicked will execute `alert(1)`.
## Recommendation
Update to version 0.3.6 or later.
OSV
CVE-2016-10531: marked is an application that is meant to parse and compile markdown
osv·2018-05-31·CVSS 6.1
CVE-2016-10531 [MEDIUM] CVE-2016-10531: marked is an application that is meant to parse and compile markdown
marked is an application that is meant to parse and compile markdown. Due to the way that marked 0.3.5 and earlier parses input, specifically HTML entities, it's possible to bypass marked's content injection protection (`sanitize: true`) to inject a `javascript:` URL. This flaw exists because `&#xNNanything;` gets parsed to what it could and leaves the rest behind, resulting in just `anything;` being left.
Debian
CVE-2016-10531: node-marked - marked is an application that is meant to parse and compile markdown. Due to the...
vendor_debian·2016·CVSS 6.1
CVE-2016-10531 [MEDIUM] CVE-2016-10531: node-marked - marked is an application that is meant to parse and compile markdown. Due to the...
marked is an application that is meant to parse and compile markdown. Due to the way that marked 0.3.5 and earlier parses input, specifically HTML entities, it's possible to bypass marked's content injection protection (`sanitize: true`) to inject a `javascript:` URL. This flaw exists because `&#xNNanything;` gets parsed to what it could and leaves the rest behind, resulting in just `anything;` being left.
Scope: local
bookworm: resolved (fixed in 0.3.6+dfsg-1)
bullseye: resolved (fixed in 0.3.6+dfsg-1)
forky: resolved (fixed in 0.3.6+dfsg-1)
sid: resolved (fixed in 0.3.6+dfsg-1)
trixie: resolved (fixed in 0.3.6+dfsg-1)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/chjj/marked/pull/592https://github.com/chjj/marked/pull/592/commits/2cff85979be8e7a026a9aca35542c470cf5da523https://nodesecurity.io/advisories/101https://github.com/chjj/marked/pull/592https://github.com/chjj/marked/pull/592/commits/2cff85979be8e7a026a9aca35542c470cf5da523https://nodesecurity.io/advisories/101
2018-05-31
Published