GHSA-5v2h-r2cx-5xgj
- Sévérité
- Élevée
- CVSS
- 7.5 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- CISA KEV
- Absente du catalogue KEV en cache
- EPSS
- Aucun score EPSS en cache
Versions touchées et corrigées
- Introduite en 0 · corrigée en 4.0.10
Le texte simplifié n'apparaît que s'il est déjà en cache. Cette page ne le génère pas.
Inefficient Regular Expression Complexity in marked
### Impact _What kind of vulnerability is it?_ Denial of service. The regular expression `inline.reflinkSearch` may cause catastrophic backtracking against some strings. PoC is the following. ```javascript import * as marked from 'marked'; console.log(marked.parse(`[x]: x \\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](`)); ``` _Who is impacted?_ Anyone who runs untrusted markdown through marked and does not use a worker with a time limit. ### Patches _Has the problem been patched?_ Yes _What versions should users upgra…
Alias : CVE-2022-21681
Alerte sur OSV.dev · publiée le 2022-01-14 · modifiée le 2026-09-10
- https://github.com/markedjs/marked/security/advisories/GHSA-5v2h-r2cx-5xgj
- https://nvd.nist.gov/vuln/detail/CVE-2022-21681
- https://github.com/markedjs/marked/commit/8f806573a3f6c6b7a39b8cdb66ab5ebb8d55a5f5
- https://github.com/markedjs/marked/commit/c4a3ccd344b6929afa8a1d50ac54a721e57012c0
- https://github.com/markedjs/marked
- https://lists.fedoraproject.org/archives/list/[email protected]/message/AIXDMC3CSHYW3YWVSQOXAWLUYQHAO5UX