VulnerableCode Package Details - pkg:npm/marked@0.3.7

Staging Environment: Content and features may be unstable or change without notice.

Search for packages

Package details: pkg:npm/marked@0.3.7

Essentials
History (8)

purl	pkg:npm/marked@0.3.7

Next non-vulnerable version	4.0.10
Latest non-vulnerable version	18.0.2
Risk	4.0

Vulnerabilities affecting this package (5)

Vulnerability	Summary	Fixed by
VCID-686c-bk5y-k7gr Aliases: CVE-2018-25110 GHSA-p9wx-2529-fp83	Marked prior to version 0.3.17 is vulnerable to a Regular Expression Denial of Service (ReDoS) attack due to catastrophic backtracking in several regular expressions used for parsing HTML tags and markdown links. An attacker can exploit this vulnerability by providing specially crafted markdown input, such as deeply nested or repetitively structured brackets or tag attributes, which cause the parser to hang and lead to a Denial of Service.	0.3.17 Affected by 3 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}
VCID-8wcn-cw8p-57e8 Aliases: CVE-2017-16114 GHSA-x5pg-88wf-qq4p	Regular Expression Denial of Service in marked	0.3.9 Affected by 3 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}
VCID-9wvm-us1k-6bhs Aliases: CVE-2022-21680 GHSA-rrrm-qjm4-v8hf	Inefficient Regular Expression Complexity in marked	4.0.10 Affected by 0 other vulnerabilities.
VCID-bcyk-4f2v-xkdv Aliases: CVE-2017-17461 GHSA-crmx-v835-hcp4	Moderate severity vulnerability that affects marked	0.3.9 Affected by 3 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}
VCID-qf5t-nkv6-duac Aliases: CVE-2022-21681 GHSA-5v2h-r2cx-5xgj	Inefficient Regular Expression Complexity in marked	4.0.10 Affected by 0 other vulnerabilities.

Vulnerabilities fixed by this package (1)

Vulnerability	Summary	Aliases
VCID-uqqa-ue5d-fyc3	Marked vulnerable to XSS from data URIs	CVE-2017-1000427 GHSA-7px7-7xjx-hxm8

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2026-06-12T20:02:14.291219+00:00	GitLab Importer	Affected by	VCID-686c-bk5y-k7gr	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/marked/CVE-2018-25110.yml	38.6.0
2026-06-12T17:55:53.307046+00:00	GitLab Importer	Affected by	VCID-9wvm-us1k-6bhs	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/marked/CVE-2022-21680.yml	38.6.0
2026-06-12T17:55:50.144531+00:00	GitLab Importer	Affected by	VCID-qf5t-nkv6-duac	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/marked/CVE-2022-21681.yml	38.6.0
2026-06-12T17:00:49.448640+00:00	GitLab Importer	Affected by	VCID-8wcn-cw8p-57e8	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/marked/CVE-2017-16114.yml	38.6.0
2026-06-12T16:56:47.827420+00:00	GitLab Importer	Affected by	VCID-bcyk-4f2v-xkdv	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/marked/CVE-2017-17461.yml	38.6.0
2026-06-12T15:40:15.153096+00:00	GitLab Importer	Fixing	VCID-uqqa-ue5d-fyc3	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/marked/CVE-2017-1000427.yml	38.6.0
2026-06-12T08:09:56.293153+00:00	GithubOSV Importer	Fixing	VCID-uqqa-ue5d-fyc3	https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/01/GHSA-7px7-7xjx-hxm8/GHSA-7px7-7xjx-hxm8.json	38.6.0
2026-06-11T20:23:57.877590+00:00	GHSA Importer	Fixing	VCID-uqqa-ue5d-fyc3	https://github.com/advisories/GHSA-7px7-7xjx-hxm8	38.6.0