Marked Project
Marked Project Marked: vulnerabilidades y CVE
Marked Project Marked tiene 11 vulnerabilidades publicadas, 1 de ellas en los últimos 12 meses. 0 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE11
Últimos 12 meses1
Críticas0
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2026-41680 | Alta (8.7) | 0.51% | — | 24 abr 2026 | Marked is a markdown parser and compiler. From 18.0.0 to 18.0.1, a critical Denial of Service (DoS) vulnerability exists in marked. By providing a specific 3-byte input sequence a tab, a vertical tab, and a newline… |
| CVE-2018-25110 | Media (6.9) | 0.58% | — | 23 may 2025 | Marked prior to version 0.3.17 is vulnerable to a Regular Expression Denial of Service (ReDoS) attack due to catastrophic backtracking in several regular expressions used for parsing HTML tags and markdown links. An… |
| CVE-2022-21681 | Alta (7.5) | 2.8% | — | 14 ene 2022 | Marked is a markdown parser and compiler. Prior to version 4.0.10, the regular expression `inline.reflinkSearch` may cause catastrophic backtracking against some strings and lead to a denial of service (DoS). Anyone who… |
| CVE-2022-21680 | Alta (7.5) | 2.9% | — | 14 ene 2022 | Marked is a markdown parser and compiler. Prior to version 4.0.10, the regular expression `block.def` may cause catastrophic backtracking against some strings and lead to a regular expression denial of service (ReDoS).… |
| CVE-2021-21306 | Alta (7.5) | 2.5% | — | 8 feb 2021 | Marked is an open-source markdown parser and compiler (npm package "marked"). In marked from version 1.1.1 and before version 2.0.0, there is a Regular expression Denial of Service vulnerability. This vulnerability can… |
| CVE-2014-3743 | Media (6.1) | 1.7% | — | 6 ene 2020 | Multiple cross-site scripting (XSS) vulnerabilities in the Marked module before 0.3.1 for Node.js allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) gfm codeblocks (language) or (2)… |
| CVE-2017-16114 | Alta (7.5) | 1.8% | — | 7 jun 2018 | The marked module is vulnerable to a regular expression denial of service. Based on the information published in the public issue, 1k characters can block for around 6 seconds. |
| CVE-2016-10531 | Media (6.1) | 1.5% | — | 31 may 2018 | marked is an application that is meant to parse and compile markdown. Due to the way that marked 0.3.5 and earlier parses input, specifically HTML entities, it's possible to bypass marked's content injection protection… |
| CVE-2017-1000427 | Media (6.1) | 1.5% | — | 2 ene 2018 | marked version 0.3.6 and earlier is vulnerable to an XSS attack in the data: URI parser. |
| CVE-2015-8854 | Alta (7.5) | 4.3% | — | 23 ene 2017 | The marked package before 0.3.4 for Node.js allows attackers to cause a denial of service (CPU consumption) via unspecified vectors that trigger a "catastrophic backtracking issue for the em inline rule," aka a "regular… |
| CVE-2015-1370 | Media (4.3) | 2.1% | — | 27 ene 2015 | Incomplete blacklist vulnerability in marked 0.3.2 and earlier for Node.js allows remote attackers to conduct cross-site scripting (XSS) attacks via a vbscript tag in a link. |