Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-xf3w-qz3m-h7fv
Vulnerability ID VCID-xf3w-qz3m-h7fv
Aliases CVE-2022-21680
GHSA-rrrm-qjm4-v8hf
Summary Inefficient Regular Expression Complexity The regular expression `block.def` may cause catastrophic backtracking against some strings and lead to a regular expression denial of service (ReDoS). Anyone who runs untrusted markdown through a vulnerable version of marked and does not use a worker with a time limit may be affected. This issue is patched As a workaround, avoid running untrusted markdown through marked or run marked on a worker thread and set a reasonable time limit to prevent draining resources.
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (5)
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-1333 Inefficient Regular Expression Complexity
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-186 Overly Restrictive Regular Expression
CWE-400 Uncontrolled Resource Consumption
System Score Found at
cvssv3 7.5 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-21680.json
epss 0.00708 https://api.first.org/data/v1/epss?cve=CVE-2022-21680
epss 0.00708 https://api.first.org/data/v1/epss?cve=CVE-2022-21680
epss 0.00708 https://api.first.org/data/v1/epss?cve=CVE-2022-21680
epss 0.00708 https://api.first.org/data/v1/epss?cve=CVE-2022-21680
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-rrrm-qjm4-v8hf
cvssv3.1 7.5 https://github.com/markedjs/marked
generic_textual HIGH https://github.com/markedjs/marked
cvssv3.1 7.5 https://github.com/markedjs/marked/commit/c4a3ccd344b6929afa8a1d50ac54a721e57012c0
generic_textual HIGH https://github.com/markedjs/marked/commit/c4a3ccd344b6929afa8a1d50ac54a721e57012c0
cvssv3.1 7.5 https://github.com/markedjs/marked/releases/tag/v4.0.10
generic_textual HIGH https://github.com/markedjs/marked/releases/tag/v4.0.10
cvssv3.1 7.5 https://github.com/markedjs/marked/security/advisories/GHSA-rrrm-qjm4-v8hf
cvssv3.1_qr HIGH https://github.com/markedjs/marked/security/advisories/GHSA-rrrm-qjm4-v8hf
generic_textual HIGH https://github.com/markedjs/marked/security/advisories/GHSA-rrrm-qjm4-v8hf
cvssv3.1 7.5 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AIXDMC3CSHYW3YWVSQOXAWLUYQHAO5UX
generic_textual HIGH https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AIXDMC3CSHYW3YWVSQOXAWLUYQHAO5UX
cvssv3.1 7.5 https://nvd.nist.gov/vuln/detail/CVE-2022-21680
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2022-21680
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-21680.json
https://api.first.org/data/v1/epss?cve=CVE-2022-21680
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-21680
https://github.com/markedjs/marked
https://github.com/markedjs/marked/commit/c4a3ccd344b6929afa8a1d50ac54a721e57012c0
https://github.com/markedjs/marked/releases/tag/v4.0.10
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AIXDMC3CSHYW3YWVSQOXAWLUYQHAO5UX
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AIXDMC3CSHYW3YWVSQOXAWLUYQHAO5UX/
2082705 https://bugzilla.redhat.com/show_bug.cgi?id=2082705
CVE-2022-21680 https://nvd.nist.gov/vuln/detail/CVE-2022-21680
GHSA-rrrm-qjm4-v8hf https://github.com/advisories/GHSA-rrrm-qjm4-v8hf
GHSA-rrrm-qjm4-v8hf https://github.com/markedjs/marked/security/advisories/GHSA-rrrm-qjm4-v8hf
RHSA-2023:3642 https://access.redhat.com/errata/RHSA-2023:3642
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-21680.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/markedjs/marked
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/markedjs/marked/commit/c4a3ccd344b6929afa8a1d50ac54a721e57012c0
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/markedjs/marked/releases/tag/v4.0.10
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/markedjs/marked/security/advisories/GHSA-rrrm-qjm4-v8hf
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AIXDMC3CSHYW3YWVSQOXAWLUYQHAO5UX
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2022-21680
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.72563
EPSS Score 0.00708
Published At June 4, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-02T04:40:59.021257+00:00 GitLab Importer Import https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/marked/CVE-2022-21680.yml 38.6.0