CVE-2015-1370: VBScript Content Injection in marked
Summary
CVE-2015-1370: VBScript Content Injection in marked. Affects marked versions < 0.3.3. Fixed in 0.3.3. How to fix ↓
Also tracked for
- node-marked · Debian:11
The same CVE-2015-1370 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The marked package is an open-source library for parsing and rendering Markdown documents. It is commonly used in web applications to convert Markdown text into HTML. The vulnerability affects versions 0.3.2 and earlier of marked. The package allows for cross-site scripting (XSS) attacks even when the sanitize:true option is set.
Vulnerability Detail
The vulnerability in marked allows an attacker to inject malicious VBScript code into the rendered HTML, leading to potential XSS attacks. This can occur even when the sanitize:true option is enabled, making it possible for an attacker to execute arbitrary code in the context of the user's browser. The vulnerability is rated as moderate severity (CWE-79) and was first published on October 24, 2017.
How To Fix
Minimum fixed version
0.3.3
This is the first release that contains the fix.
npm install marked@0.3.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update to the latest version of the marked package to mitigate the risk of XSS attacks.
Conclusion
The marked package versions 0.3.2 and earlier are vulnerable to a cross-site scripting (XSS) attack, even when the sanitize:true option is enabled. To mitigate this vulnerability, it is crucial to update to version 0.3.3 or later. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for marked →
FAQ
The vulnerability allows an attacker to execute arbitrary code in the user's browser, potentially leading to unauthorized access, data theft, or other malicious activities.
No, the vulnerability affects versions 0.3.2 and earlier. Updating to version 0.3.3 or later resolves the issue.
Yes, the vulnerability can be exploited remotely by tricking a user into visiting a malicious website or clicking on a specially crafted link.
There are no known instances of this vulnerability being actively exploited in the wild. However, it is still important to update to the latest version to prevent potential attacks.
For more information about this vulnerability, you can refer to the GitHub advisory database entry: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2017/10/GHSA-cfjh-p3g4-3q2f/GHSA-cfjh-p3g4-3q2f.json
References
Related vulnerabilities
Recent vulnerabilities recorded for marked.
