Denial of Service Vulnerability in Marked Package: CVE-2022-21681

Sponsored Habilume Habit tracker with a companion that grows with you Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent. App Store Google Play

Background

Marked is a popular markdown parser and compiler widely used in web applications to convert markdown text into HTML. It is known for its speed and flexibility, allowing developers to easily integrate markdown support into their projects. However, prior to version 4.0.10, Marked contained a vulnerability that could lead to denial of service (DoS) when processing untrusted markdown input.

Vulnerability Detail

The vulnerability arises from a regular expression named 'inline.reflinkSearch' within the Marked package. This regex can cause catastrophic backtracking when processing certain strings, leading to excessive resource consumption and potentially crashing the application. The issue primarily affects users who run untrusted markdown without implementing proper resource limits, making it a significant risk for web applications that accept user-generated content.

Workaround

As a temporary workaround, avoid processing untrusted markdown through the Marked package. Alternatively, you can run Marked on a worker thread with a defined time limit to prevent resource exhaustion. For example, you can use the following code snippet to set a timeout when processing markdown:

const { Worker } = require('worker_threads');

function runService(markdown) {
  return new Promise((resolve, reject) => {
    const worker = new Worker('./markdownWorker.js', { workerData: markdown });
    worker.on('message', resolve);
    worker.on('error', reject);
    worker.on('exit', (code) => {
      if (code !== 0) {
        reject(new Error(`Worker stopped with exit code ${code}`));
      }
    });
    setTimeout(() => {
      worker.terminate();
      reject(new Error('Processing timeout'));
    }, 5000); // Set timeout to 5 seconds
  });
}

Conclusion

CVE-2022-21681 is a significant vulnerability in the Marked package that can lead to denial of service if untrusted markdown is processed. It is crucial to update to version 4.0.10 or later to mitigate this risk. Implementing workarounds can provide temporary relief until the update is applied.

See every vulnerability recorded for node-marked →

FAQ