CVE-2016-10531: Cross-Site Scripting Vulnerability in marked
Summary
CVE-2016-10531: Sanitization bypass using HTML Entities in marked. Affects marked versions < 0.3.6. Fixed in 0.3.6. How to fix ↓
Also tracked for
- node-marked · Debian:11
The same CVE-2016-10531 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The marked package is an open-source library used for parsing and rendering Markdown content in various applications. It provides a simple and efficient way to convert Markdown text into HTML. However, versions of marked prior to 0.3.6 are vulnerable to a cross-site scripting (XSS) attack when the sanitize option is set to true. This vulnerability allows an attacker to inject malicious code into link components, potentially leading to unauthorized access, data theft, or other malicious activities.
Vulnerability Detail
The vulnerability in marked arises from the improper handling of link URIs containing HTML entities when the sanitize option is enabled. HTML entities are parsed on a best-effort basis and included in the resulting link. However, if the parsing fails, the character is omitted. This behavior can be exploited by an attacker to craft a link URI that executes arbitrary JavaScript code when clicked. For example, a link URI like javascript֍ocument;alert(1) will render as a valid link that triggers an alert(1) when clicked.
How To Fix
Latest published version: 18.1.1 as of 23 Oct 2026
npm install marked@18.1.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.3.6
This is the first release that contains the fix.
npm install marked@0.3.6Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating to the latest version is not immediately feasible, a temporary workaround is to disable the sanitize option or use a custom sanitization function to properly handle link URIs containing HTML entities. Here is an example of a custom sanitization function in JavaScript:
function sanitizeLinkUri(uri) {
// Implement custom sanitization logic here
return uri;
}
By using this custom function, you can ensure that link URIs with HTML entities are properly sanitized before being processed by marked.
Conclusion
The marked package versions prior to 0.3.6 are vulnerable to a cross-site scripting (XSS) attack when the sanitize option is enabled. It is crucial to update to the latest version or apply the recommended workaround to mitigate the risk of exploitation. For further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for marked →
FAQ
This vulnerability allows an attacker to execute arbitrary JavaScript code in the context of a user's browser when they click on a specially crafted link. This can lead to various malicious activities, such as stealing sensitive information, performing unauthorized actions on behalf of the user, or spreading malware.
No, only versions prior to 0.3.6 are affected by this vulnerability. It is recommended to update to the latest version to ensure the security of your application.
While specific exploits targeting this vulnerability may exist, there are no publicly known exploits at the time of this advisory. However, it is crucial to address this vulnerability promptly to mitigate any potential risks.
No, a CVSS score is not available for this vulnerability. However, given the nature of the vulnerability and its potential impact, it is classified as a high-severity issue.
You can find more information about the marked package, including documentation, release notes, and community support, on the official GitHub repository: https://github.com/markedjs/marked
References
Related vulnerabilities
Recent vulnerabilities recorded for marked.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
