Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-b8e2-2cre-2bbt
Vulnerability ID VCID-b8e2-2cre-2bbt
Aliases CVE-2018-25110
GHSA-p9wx-2529-fp83
Summary Marked allows Regular Expression Denial of Service (ReDoS) attacks Marked prior to version 0.3.17 is vulnerable to a Regular Expression Denial of Service (ReDoS) attack due to catastrophic backtracking in several regular expressions used for parsing HTML tags and markdown links. An attacker can exploit this vulnerability by providing specially crafted markdown input, such as deeply nested or repetitively structured brackets or tag attributes, which cause the parser to hang and lead to a Denial of Service.
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-1333 Inefficient Regular Expression Complexity
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.00774 https://api.first.org/data/v1/epss?cve=CVE-2018-25110
epss 0.00774 https://api.first.org/data/v1/epss?cve=CVE-2018-25110
epss 0.00774 https://api.first.org/data/v1/epss?cve=CVE-2018-25110
epss 0.00774 https://api.first.org/data/v1/epss?cve=CVE-2018-25110
epss 0.00774 https://api.first.org/data/v1/epss?cve=CVE-2018-25110
cvssv4 6.9 https://github.com/Checkmarx/Vulnerabilities-Proofs-of-Concept/tree/main/2018/CVE-2018-25110
generic_textual MODERATE https://github.com/Checkmarx/Vulnerabilities-Proofs-of-Concept/tree/main/2018/CVE-2018-25110
ssvc Track https://github.com/Checkmarx/Vulnerabilities-Proofs-of-Concept/tree/main/2018/CVE-2018-25110
cvssv4 6.9 https://github.com/markedjs/marked
generic_textual MODERATE https://github.com/markedjs/marked
cvssv4 6.9 https://github.com/markedjs/marked/commit/20bfc106013ed45713a21672ad4a34df94dcd485
generic_textual MODERATE https://github.com/markedjs/marked/commit/20bfc106013ed45713a21672ad4a34df94dcd485
ssvc Track https://github.com/markedjs/marked/commit/20bfc106013ed45713a21672ad4a34df94dcd485
cvssv4 6.9 https://github.com/markedjs/marked/issues/1070
generic_textual MODERATE https://github.com/markedjs/marked/issues/1070
ssvc Track https://github.com/markedjs/marked/issues/1070
cvssv4 6.9 https://github.com/markedjs/marked/pull/1083
generic_textual MODERATE https://github.com/markedjs/marked/pull/1083
ssvc Track https://github.com/markedjs/marked/pull/1083
cvssv4 6.9 https://nvd.nist.gov/vuln/detail/CVE-2018-25110
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2018-25110
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2018-25110
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-25110
https://github.com/markedjs/marked
https://github.com/markedjs/marked/commit/20bfc106013ed45713a21672ad4a34df94dcd485
https://github.com/markedjs/marked/issues/1070
https://github.com/markedjs/marked/pull/1083
CVE-2018-25110 https://github.com/Checkmarx/Vulnerabilities-Proofs-of-Concept/tree/main/2018/CVE-2018-25110
CVE-2018-25110 https://nvd.nist.gov/vuln/detail/CVE-2018-25110
GHSA-p9wx-2529-fp83 https://github.com/advisories/GHSA-p9wx-2529-fp83
No exploits are available.
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N Found at https://github.com/Checkmarx/Vulnerabilities-Proofs-of-Concept/tree/main/2018/CVE-2018-25110
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-05-23T15:09:00Z/ Found at https://github.com/Checkmarx/Vulnerabilities-Proofs-of-Concept/tree/main/2018/CVE-2018-25110
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N Found at https://github.com/markedjs/marked
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N Found at https://github.com/markedjs/marked/commit/20bfc106013ed45713a21672ad4a34df94dcd485
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-05-23T15:09:00Z/ Found at https://github.com/markedjs/marked/commit/20bfc106013ed45713a21672ad4a34df94dcd485
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N Found at https://github.com/markedjs/marked/issues/1070
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-05-23T15:09:00Z/ Found at https://github.com/markedjs/marked/issues/1070
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N Found at https://github.com/markedjs/marked/pull/1083
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-05-23T15:09:00Z/ Found at https://github.com/markedjs/marked/pull/1083
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N Found at https://nvd.nist.gov/vuln/detail/CVE-2018-25110
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.73959
EPSS Score 0.00774
Published At June 4, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-04T16:24:03.407590+00:00 GitLab Importer Import https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/marked/CVE-2018-25110.yml 38.6.0