CVE-2014-3743: Content Injection Vulnerabilities in marked

marked Updated 02 Oct 2025

Summary

31/08/2020

Disclosed on

CVE-2014-3743

CVE

Yes i

Fix available

Moderate

Severity

6.1

CVSS Score

CVE-2014-3743: Multiple Content Injection Vulnerabilities in marked. Affects marked versions < 0.3.1. Fixed in 0.3.1. How to fix ↓

Also tracked for

node-marked · Debian:11

The same CVE-2014-3743 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM

Drag & drop your file here or Browse

Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX

Upload a supported dependency manifest or SBOM. No installation or source-code access required.

See supported files and SBOM formats

SBOM sbom.json · bom.json · bom.xml · *.spdx.json · *.cdx.json · *.cdx.xml

Java pom.xml · gradle.lockfile · buildscript-gradle.lockfile

Javascript package-lock.json · yarn.lock · pnpm-lock.yaml

PHP composer.lock

Python poetry.lock · requirements.txt · Pipfile.lock

Go go.mod

Rust Cargo.lock

Ruby Gemfile.lock

Dart pubspec.lock

C/C++ conan.lock

Elixir mix.lock

Enter your work email to receive your report link.

Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required.

Background

marked is an npm package used for parsing and rendering Markdown content. It provides a simple and efficient way to convert Markdown syntax into HTML. However, versions 0.3.0 and earlier of marked are susceptible to two cross-site scripting (XSS) vulnerabilities, even when the sanitize option is enabled. These vulnerabilities can be exploited through GFM Codeblocks and JavaScript URLs.

Vulnerability Detail

The identified vulnerabilities in marked can lead to content injection attacks, allowing malicious actors to execute arbitrary JavaScript code in the context of a user's browser. This can result in various security risks, including session hijacking, data theft, and unauthorized actions on behalf of the user. The vulnerabilities affect versions 0.3.0 and earlier of marked, and they have a CVSS score of 6.1 (Moderate). The CWE ID associated with these vulnerabilities is CWE-79.

How To Fix

Minimum fixed version

0.3.1

This is the first release that contains the fix.

npm install marked@0.3.1

Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →

Conclusion

In conclusion, versions 0.3.0 and earlier of marked are vulnerable to content injection attacks through GFM Codeblocks and JavaScript URLs. Upgrading to version 0.3.1 or later is crucial to address these vulnerabilities and ensure safer rendering of Markdown content. For further assistance or support in vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for marked →