Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:npm/marked@0.3.3
purl pkg:npm/marked@0.3.3
Next non-vulnerable version 4.0.10
Latest non-vulnerable version 18.0.2
Risk 4.0
Vulnerabilities affecting this package (10)
Vulnerability Summary Fixed by
VCID-1vxb-uvrf-63fn
Aliases:
GMS-2016-24
Sanitization bypass using HTML Entities Due to the way that marked parses input, specifically HTML entities, it's possible to bypass marked's content injection protection (`sanitize: true`) to inject a `javascript:` URL. This flaw exists because `&#xNNanything;` gets parsed to what it could and leaves the rest behind, resulting in just `anything;` being left.
0.3.6
Affected by 7 other vulnerabilities.
VCID-686c-bk5y-k7gr
Aliases:
CVE-2018-25110
GHSA-p9wx-2529-fp83
Marked prior to version 0.3.17 is vulnerable to a Regular Expression Denial of Service (ReDoS) attack due to catastrophic backtracking in several regular expressions used for parsing HTML tags and markdown links. An attacker can exploit this vulnerability by providing specially crafted markdown input, such as deeply nested or repetitively structured brackets or tag attributes, which cause the parser to hang and lead to a Denial of Service.
0.3.17
Affected by 3 other vulnerabilities.
VCID-8wcn-cw8p-57e8
Aliases:
CVE-2017-16114
GHSA-x5pg-88wf-qq4p
Regular Expression Denial of Service in marked
0.3.9
Affected by 3 other vulnerabilities.
VCID-9wvm-us1k-6bhs
Aliases:
CVE-2022-21680
GHSA-rrrm-qjm4-v8hf
Inefficient Regular Expression Complexity in marked
4.0.10
Affected by 0 other vulnerabilities.
VCID-bcyk-4f2v-xkdv
Aliases:
CVE-2017-17461
GHSA-crmx-v835-hcp4
Moderate severity vulnerability that affects marked
0.3.9
Affected by 3 other vulnerabilities.
VCID-e79f-8rxd-q3e6
Aliases:
CVE-2016-10531
GHSA-vfvf-mqq8-rwqc
Sanitization bypass using HTML Entities in marked
0.3.6
Affected by 7 other vulnerabilities.
VCID-fczp-sf61-7bft
Aliases:
GMS-2017-212
Regular Expression Denial of Service The marked module is vulnerable to a regular expression denial of service. Based on the information published in the public issue, 1k characters can block for around 6 seconds.
0.3.9
Affected by 3 other vulnerabilities.
VCID-jmm3-pphv-nygr
Aliases:
CVE-2015-8854
GHSA-hjcp-j389-59ff
Regular Expression Denial of Service in marked
0.3.4
Affected by 9 other vulnerabilities.
VCID-qf5t-nkv6-duac
Aliases:
CVE-2022-21681
GHSA-5v2h-r2cx-5xgj
Inefficient Regular Expression Complexity in marked
4.0.10
Affected by 0 other vulnerabilities.
VCID-uqqa-ue5d-fyc3
Aliases:
CVE-2017-1000427
GHSA-7px7-7xjx-hxm8
Marked vulnerable to XSS from data URIs
0.3.7
Affected by 5 other vulnerabilities.
Vulnerabilities fixed by this package (2)
Vulnerability Summary Aliases
VCID-34a4-7ede-7qfd VBScript Content Injection in marked CVE-2015-1370
GHSA-cfjh-p3g4-3q2f
VCID-dcts-5pkt-tfh7 Withdrawn Advisory: marked cross-site scripting vulnerability GHSA-32vw-r77c-gm67

Date Actor Action Vulnerability Source VulnerableCode Version
2026-06-12T20:02:14.275429+00:00 GitLab Importer Affected by VCID-686c-bk5y-k7gr https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/marked/CVE-2018-25110.yml 38.6.0
2026-06-12T17:55:53.291207+00:00 GitLab Importer Affected by VCID-9wvm-us1k-6bhs https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/marked/CVE-2022-21680.yml 38.6.0
2026-06-12T17:55:50.128800+00:00 GitLab Importer Affected by VCID-qf5t-nkv6-duac https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/marked/CVE-2022-21681.yml 38.6.0
2026-06-12T17:23:35.994298+00:00 GitLab Importer Fixing VCID-dcts-5pkt-tfh7 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/marked/GHSA-32vw-r77c-gm67.yml 38.6.0
2026-06-12T17:00:49.432931+00:00 GitLab Importer Affected by VCID-8wcn-cw8p-57e8 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/marked/CVE-2017-16114.yml 38.6.0
2026-06-12T16:59:24.797149+00:00 GitLab Importer Affected by VCID-e79f-8rxd-q3e6 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/marked/CVE-2016-10531.yml 38.6.0
2026-06-12T16:56:47.810088+00:00 GitLab Importer Affected by VCID-bcyk-4f2v-xkdv https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/marked/CVE-2017-17461.yml 38.6.0
2026-06-12T16:56:38.420786+00:00 GitLab Importer Affected by VCID-uqqa-ue5d-fyc3 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/marked/CVE-2017-1000427.yml 38.6.0
2026-06-12T16:55:36.921188+00:00 GitLab Importer Affected by VCID-jmm3-pphv-nygr https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/marked/CVE-2015-8854.yml 38.6.0
2026-06-12T16:54:20.095514+00:00 GitLab Importer Affected by VCID-fczp-sf61-7bft https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/marked/GMS-2017-212.yml 38.6.0
2026-06-12T16:50:00.794016+00:00 GitLab Importer Affected by VCID-1vxb-uvrf-63fn https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/marked/GMS-2016-24.yml 38.6.0
2026-06-12T15:39:12.099872+00:00 GitLab Importer Fixing VCID-34a4-7ede-7qfd https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/marked/CVE-2015-1370.yml 38.6.0
2026-06-12T08:01:54.366956+00:00 GithubOSV Importer Fixing VCID-dcts-5pkt-tfh7 https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/08/GHSA-32vw-r77c-gm67/GHSA-32vw-r77c-gm67.json 38.6.0
2026-06-12T07:52:15.845968+00:00 GithubOSV Importer Fixing VCID-34a4-7ede-7qfd https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2017/10/GHSA-cfjh-p3g4-3q2f/GHSA-cfjh-p3g4-3q2f.json 38.6.0
2026-06-12T07:19:02.706120+00:00 Npm Importer Fixing VCID-34a4-7ede-7qfd https://github.com/nodejs/security-wg/blob/main/vuln/npm/24.json 38.6.0
2026-06-12T07:19:02.496713+00:00 Npm Importer Affected by VCID-jmm3-pphv-nygr https://github.com/nodejs/security-wg/blob/main/vuln/npm/23.json 38.6.0
2026-06-11T20:26:23.384305+00:00 GHSA Importer Fixing VCID-dcts-5pkt-tfh7 https://github.com/advisories/GHSA-32vw-r77c-gm67 38.6.0
2026-06-11T20:23:45.014267+00:00 GHSA Importer Fixing VCID-34a4-7ede-7qfd https://github.com/advisories/GHSA-cfjh-p3g4-3q2f 38.6.0