What kind of vulnerability is it?
Denial of service.
The regular expression block.def
may cause catastrophic backtracking against some strings.
PoC is the following.
import * as marked from "marked";
marked.parse(`[x]:${' '.repeat(1500)}x ${' '.repeat(1500)} x`);
Who is impacted?
Anyone who runs untrusted markdown through marked and does not use a worker with a time limit.
Has the problem been patched?
Yes
What versions should users upgrade to?
4.0.10
Is there a way for users to fix or remediate the vulnerability without upgrading?
Do not run untrusted markdown through marked or run marked on a worker thread and set a reasonable time limit to prevent draining resources.
Are there any links users can visit to find out more?
If you have any questions or comments about this advisory:
github.com/markedjs/marked
github.com/markedjs/marked/commit/c4a3ccd344b6929afa8a1d50ac54a721e57012c0
github.com/markedjs/marked/releases/tag/v4.0.10
github.com/markedjs/marked/security/advisories/GHSA-rrrm-qjm4-v8hf
lists.fedoraproject.org/archives/list/[email protected]/message/AIXDMC3CSHYW3YWVSQOXAWLUYQHAO5UX
nvd.nist.gov/vuln/detail/CVE-2022-21680