CVE-2017-1000427: marked - XSS Vulnerability in data: URI Parser
Summary
CVE-2017-1000427: Marked vulnerable to XSS from data URIs. Affects marked versions < 0.3.7. Fixed in 0.3.7. How to fix ↓
Also tracked for
- node-marked · Debian:11
The same CVE-2017-1000427 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
marked is an npm package that is used for parsing and rendering markdown. It is widely used in various applications and provides a convenient way to convert markdown into HTML. However, versions 0.3.6 and earlier of marked are vulnerable to an XSS attack in the data: URI parser.
Vulnerability Detail
The vulnerability in marked allows an attacker to inject malicious code into the data: URI parser, which can be triggered when processing user-generated content. This can lead to the execution of arbitrary JavaScript code in the context of the victim's browser, potentially compromising the confidentiality and integrity of user data. The vulnerability has a CVSS score of 6.1, indicating a moderate severity.
How To Fix
Minimum fixed version
0.3.7
This is the first release that contains the fix.
npm install marked@0.3.7Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version of marked is not immediately feasible, a possible workaround is to sanitize user-generated content before passing it to the data: URI parser. This can be done by using a library or function that removes or escapes any potentially malicious code from the input. Here is an example of how to sanitize user input in JavaScript:
function sanitizeInput(input) {
// Sanitize input to prevent XSS
// ... implementation ...
return sanitizedInput;
}
Conclusion
In conclusion, marked version 0.3.6 and earlier are vulnerable to an XSS attack in the data: URI parser. To mitigate this vulnerability, it is recommended to upgrade to marked version 0.3.7 or later. Alternatively, developers can sanitize user-generated content before processing it with the data: URI parser. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for marked →
FAQ
The vulnerability allows an attacker to execute arbitrary JavaScript code in the victim's browser, potentially compromising user data and the integrity of the application.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities using package-lock.json.
Yes, upgrading to marked version 0.3.7 or later fixes the XSS vulnerability in the data: URI parser.
A possible workaround is to sanitize user-generated content before passing it to the data: URI parser. This can help mitigate the risk of XSS attacks.
The CVSS score of this vulnerability is 6.1, indicating a moderate severity.
Related vulnerabilities
Recent vulnerabilities recorded for marked.
