CVE-2022-21681
published 2022-01-14CVE-2022-21681: Marked is a markdown parser and compiler. Prior to version 4.0.10, the regular expression `inline.reflinkSearch` may cause catastrophic backtracking against…
PriorityP340high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
2.74%
84.7th percentile
Marked is a markdown parser and compiler. Prior to version 4.0.10, the regular expression `inline.reflinkSearch` may cause catastrophic backtracking against some strings and lead to a denial of service (DoS). Anyone who runs untrusted markdown through a vulnerable version of marked and does not use a worker with a time limit may be affected. This issue is patched in version 4.0.10. As a workaround, avoid running untrusted markdown through marked or run marked on a worker thread and set a reasonable time limit to prevent draining resources.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | node-marked | < node-marked 4.0.12+ds+~4.0.1-1 (bookworm) | node-marked 4.0.12+ds+~4.0.1-1 (bookworm) |
| fedoraproject | fedora | — | — |
| marked_project | marked | < 4.0.10 | 4.0.10 |
| marked_project | marked | >= 0 < 4.0.10 | 4.0.10 |
| markedjs | marked | < 4.0.10 | 4.0.10 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
osv7.5HIGH
vendor_debian7.5HIGH
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
marked: regular expression inline.reflinkSearch may lead Denial of Service
vendor_redhat·2022-01-14·CVSS 7.5
CVE-2022-21681 [HIGH] CWE-186 marked: regular expression inline.reflinkSearch may lead Denial of Service
marked: regular expression inline.reflinkSearch may lead Denial of Service
Marked is a markdown parser and compiler. Prior to version 4.0.10, the regular expression `inline.reflinkSearch` may cause catastrophic backtracking against some strings and lead to a denial of service (DoS). Anyone who runs untrusted markdown through a vulnerable version of marked and does not use a worker with a time limit may be affected. This issue is patched in version 4.0.10. As a workaround, avoid running untrusted markdown through marked or run marked on a worker thread and set a reasonable time limit to prevent draining resources.
A vulnerability was found in the markedjs package. Affected versions of this package are vulnerable to Regular expression Denial of Service (ReDoS) attacks, affecting system ava
Debian
CVE-2022-21681: node-marked - Marked is a markdown parser and compiler. Prior to version 4.0.10, the regular e...
vendor_debian·2022·CVSS 7.5
CVE-2022-21681 [HIGH] CVE-2022-21681: node-marked - Marked is a markdown parser and compiler. Prior to version 4.0.10, the regular e...
Marked is a markdown parser and compiler. Prior to version 4.0.10, the regular expression `inline.reflinkSearch` may cause catastrophic backtracking against some strings and lead to a denial of service (DoS). Anyone who runs untrusted markdown through a vulnerable version of marked and does not use a worker with a time limit may be affected. This issue is patched in version 4.0.10. As a workaround, avoid running untrusted markdown through marked or run marked on a worker thread and set a reasonable time limit to prevent draining resources.
Scope: local
bookworm: resolved (fixed in 4.0.12+ds+~4.0.1-1)
bullseye: open
forky: resolved (fixed in 4.0.12+ds+~4.0.1-1)
sid: resolved (fixed in 4.0.12+ds+~4.0.1-1)
trixie: resolved (fixed in 4.0.12+ds+~4.0.1-1)
GHSA
Inefficient Regular Expression Complexity in marked
ghsa·2022-01-14
CVE-2022-21681 [HIGH] CWE-1333 Inefficient Regular Expression Complexity in marked
Inefficient Regular Expression Complexity in marked
### Impact
_What kind of vulnerability is it?_
Denial of service.
The regular expression `inline.reflinkSearch` may cause catastrophic backtracking against some strings.
PoC is the following.
```javascript
import * as marked from 'marked';
console.log(marked.parse(`[x]: x
\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](`));
```
_Who is impacted?_
Anyone who runs untrusted markdown through marked and does not use a worker with a time limit.
### Patches
_Has the problem been patched?_
Yes
_What versions should users upgrade to?_
4.0.10
### Workarounds
_Is there a wa
OSV
Inefficient Regular Expression Complexity in marked
osv·2022-01-14
CVE-2022-21681 [HIGH] Inefficient Regular Expression Complexity in marked
Inefficient Regular Expression Complexity in marked
### Impact
_What kind of vulnerability is it?_
Denial of service.
The regular expression `inline.reflinkSearch` may cause catastrophic backtracking against some strings.
PoC is the following.
```javascript
import * as marked from 'marked';
console.log(marked.parse(`[x]: x
\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](`));
```
_Who is impacted?_
Anyone who runs untrusted markdown through marked and does not use a worker with a time limit.
### Patches
_Has the problem been patched?_
Yes
_What versions should users upgrade to?_
4.0.10
### Workarounds
_Is there a wa
OSV
CVE-2022-21681: Marked is a markdown parser and compiler
osv·2022-01-14·CVSS 7.5
CVE-2022-21681 [HIGH] CVE-2022-21681: Marked is a markdown parser and compiler
Marked is a markdown parser and compiler. Prior to version 4.0.10, the regular expression `inline.reflinkSearch` may cause catastrophic backtracking against some strings and lead to a denial of service (DoS). Anyone who runs untrusted markdown through a vulnerable version of marked and does not use a worker with a time limit may be affected. This issue is patched in version 4.0.10. As a workaround, avoid running untrusted markdown through marked or run marked on a worker thread and set a reasonable time limit to prevent draining resources.
No detection rules found.
No public exploits indexed.
https://github.com/markedjs/marked/commit/8f806573a3f6c6b7a39b8cdb66ab5ebb8d55a5f5https://github.com/markedjs/marked/security/advisories/GHSA-5v2h-r2cx-5xgjhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AIXDMC3CSHYW3YWVSQOXAWLUYQHAO5UX/https://github.com/markedjs/marked/commit/8f806573a3f6c6b7a39b8cdb66ab5ebb8d55a5f5https://github.com/markedjs/marked/security/advisories/GHSA-5v2h-r2cx-5xgjhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AIXDMC3CSHYW3YWVSQOXAWLUYQHAO5UX/
2022-01-14
Published