Cross-Site Scripting Vulnerabilities in Node.js Marked Package
Summary
CVE-2014-3743: Multiple cross-site scripting (XSS) vulnerabilities in the Marked module before 0.3.1 for Node.js allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) gfm codeblocks (language) or (2)... Affects node-marked versions < 0.3.1+dfsg-1. Fixed in 0.3.1+dfsg-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Marked package is a widely used Markdown parser and compiler for Node.js, enabling developers to convert Markdown text into HTML. It is valued for its speed and efficiency in rendering Markdown content. However, prior to version 0.3.1, the package was susceptible to multiple cross-site scripting (XSS) vulnerabilities, which could allow attackers to inject malicious scripts into web applications that utilize this package.
Vulnerability Detail
The vulnerabilities stem from improper handling of user input, specifically in gfm codeblocks and JavaScript URLs. Attackers could exploit these weaknesses to inject arbitrary web scripts or HTML, potentially leading to unauthorized actions, data theft, or session hijacking. The vulnerabilities were identified in versions of the Marked package before 0.3.1, posing a significant risk to applications relying on this package for Markdown processing.
How To Fix
Minimum fixed version
0.3.1+dfsg-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade node-markedTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, consider sanitizing user input before processing it with the Marked package. Implementing a library like DOMPurify can help clean the input and prevent XSS attacks. Example code for sanitization:
const DOMPurify = require('dompurify');
const { JSDOM } = require('jsdom');
const window = new JSDOM('').window;
const purify = DOMPurify(window);
const cleanInput = purify.sanitize(userInput);
const htmlOutput = marked(cleanInput);
Conclusion
The vulnerabilities in the Marked package highlight the importance of maintaining up-to-date dependencies in software projects. By upgrading to version 0.3.1 or later, developers can protect their applications from potential XSS attacks. Additionally, utilizing input sanitization techniques can provide an extra layer of security.
See every vulnerability recorded for node-marked →
FAQ
The CVSS score of this vulnerability is 6.1, indicating a moderate level of severity.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Exploitation of this vulnerability could lead to unauthorized script execution, data theft, and compromised user sessions.
Yes, you can sanitize user inputs using libraries like DOMPurify to prevent XSS attacks until you can upgrade the package.
All versions of the Marked package prior to 0.3.1 are affected by these vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for node-marked.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
