CVE-2015-1370

Severity: Unknown
CVSS: Not a CVSS v3 vector
CISA KEV: Not in the cached KEV catalog
EPSS: No cached EPSS score

Affected and fixed versions

OSV did not list a semver range for this package on the entry we stored.

Plain-language text is shown only when it is already cached. This page does not generate it.

Incomplete blacklist vulnerability in marked 0.3.2 and earlier for Node.js allows remote attackers to conduct cross-site scripting (XSS) attacks via a vbscript tag in a link.

Aliases: GHSA-cfjh-p3g4-3q2f

Advisory on OSV.dev · published 2015-01-27 · modified 2026-04-10

https://github.com/chjj/marked/issues/492
https://nodesecurity.io/advisories/marked_vbscript_injection
https://github.com/evilpacket/marked/commit/3c191144939107c45a7fa11ab6cb88be6694a1ba
http://www.openwall.com/lists/oss-security/2015/01/23/2

Affected packages

OSV did not name a package on this entry.

Scan your repository

This page is one package or one advisory. A repository scan checks the lockfile, what the code imports, and can open a pull request. Public scans need no account.

CVE-2015-1370 — Scandar