Vulnerability in node-marked package allows content injection
Summary
CVE-2016-10531: marked is an application that is meant to parse and compile markdown. Affects node-marked across 2 version ranges.
< 0.3.6+dfsg-1
< 88ce4df47c4d994dc1b1df1477a21fb893e11ddc
Fixed in 0.3.6+dfsg-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The node-marked package is an application used to parse and compile markdown. It is commonly used in Debian distributions, specifically versions 10, 11, 12, and 13. The package is vulnerable to a content injection attack due to the way it parses HTML entities. This vulnerability exists in versions 0.3.5 and earlier of the package. The package has a protection mechanism called sanitize: true, but it can be bypassed, allowing the injection of a javascript: URL. The flaw occurs because &#xNNanything; gets parsed to what it could and leaves the rest behind, resulting in just anything; being left.
Vulnerability Detail
The vulnerability (CVE-2016-10531) allows an attacker to inject a javascript: URL into the parsed content, bypassing the content injection protection of the node-marked package. This can lead to various security issues, such as cross-site scripting (XSS) attacks, where an attacker can execute arbitrary JavaScript code in the context of a victim's browser. The vulnerability has a CVSS score of 6.1, indicating a moderate severity level.
How To Fix
Minimum fixed version
0.3.6+dfsg-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade node-markedTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. Updating the package to the fixed version is the recommended solution.
Conclusion
The node-marked package is vulnerable to a content injection attack, allowing the injection of a javascript: URL. To mitigate this vulnerability, it is crucial to update the package to version 0.3.6+dfsg-1 or later. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for node-marked →
FAQ
The vulnerability allows an attacker to inject malicious JavaScript code into the parsed content, potentially leading to cross-site scripting (XSS) attacks and other security issues.
Versions 0.3.5 and earlier of the node-marked package are affected.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. It analyzes your manifest file, such as package-lock.json, and provides real-time alerts for open-source vulnerabilities.
Yes, updating the node-marked package to version 0.3.6+dfsg-1 or later will fix this vulnerability.
The CVSS score of this vulnerability is 6.1, indicating a moderate severity level.
Related vulnerabilities
Recent vulnerabilities recorded for node-marked.
