GHSA-xf5p-87ch-gxw2
GHSA-xf5p-87ch-gxw2 · Marked ReDoS due to email addresses being evaluated in quadratic time
Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.
Versions of `marked` from 0.3.14 until 0.6.2 are vulnerable to Regular Expression Denial of Service. Email addresses may be evaluated in quadratic time, allowing attackers to potentially crash the node process due to resource exhaustion. ## Recommendation Upgrade to version 0.6.2 or later.
CVSS 5.3 · Moyenne · Correctif disponible
- Publication
- Mise à jour
Pile logicielle: node
Produits et versions concernés
marked npm
- Plages de versions concernées
- SEMVER: ≥ 0.3.14, < 0.6.2
Mettez à jour vers 0.6.2
Sources originales
- https://github.com/markedjs/marked/pull/1460
- https://github.com/markedjs/marked/commit/b15e42b67cec9ded8505e9d68bb8741ad7a9590d
- https://github.com/markedjs/marked
- https://github.com/markedjs/marked/releases/tag/v0.6.2
- https://snyk.io/vuln/SNYK-JS-MARKED-174116
- https://www.npmjs.com/advisories/812
- https://osv.dev/vulnerability/GHSA-xf5p-87ch-gxw2