GHSA-xf5p-87ch-gxw2
GHSA-xf5p-87ch-gxw2 · Marked ReDoS due to email addresses being evaluated in quadratic time
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
Versions of `marked` from 0.3.14 until 0.6.2 are vulnerable to Regular Expression Denial of Service. Email addresses may be evaluated in quadratic time, allowing attackers to potentially crash the node process due to resource exhaustion. ## Recommendation Upgrade to version 0.6.2 or later.
CVSS 5.3 · Media · Corrección disponible
- Publicación
- Actualización
Pila tecnológica: node
Productos y versiones afectados
marked npm
- Intervalos de versiones afectados
- SEMVER: ≥ 0.3.14, < 0.6.2
Actualiza a 0.6.2
Fuentes originales
- https://github.com/markedjs/marked/pull/1460
- https://github.com/markedjs/marked/commit/b15e42b67cec9ded8505e9d68bb8741ad7a9590d
- https://github.com/markedjs/marked
- https://github.com/markedjs/marked/releases/tag/v0.6.2
- https://snyk.io/vuln/SNYK-JS-MARKED-174116
- https://www.npmjs.com/advisories/812
- https://osv.dev/vulnerability/GHSA-xf5p-87ch-gxw2