Cross-Site Scripting Vulnerability in Node.js Package 'node-marked'
Summary
DEBIAN-CVE-2015-1370: Incomplete blacklist vulnerability in marked 0.3.2 and earlier for Node.js allows remote attackers to conduct cross-site scripting (XSS) attacks via a vbscript tag in a link. Affects node-marked versions < 0.3.6+dfsg-1. Fixed in 0.3.6+dfsg-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'node-marked' package is a Markdown parser and compiler for Node.js, widely used for converting Markdown text into HTML. It is known for its speed and flexibility, allowing developers to easily integrate Markdown processing into their applications. However, versions 0.3.2 and earlier are vulnerable to an incomplete blacklist issue that can lead to cross-site scripting (XSS) attacks, posing a significant security risk to applications using this package.
Vulnerability Detail
The vulnerability arises from an incomplete blacklist in the 'marked' package, which allows remote attackers to inject malicious scripts via a vbscript tag in a link. This can lead to XSS attacks, where an attacker can execute arbitrary JavaScript in the context of a user's browser, potentially compromising user data and application integrity. The vulnerability affects all versions up to 0.3.2, making it critical for developers to address it promptly.
How To Fix
Minimum fixed version
0.3.6+dfsg-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade node-markedTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can sanitize user inputs to remove any potentially harmful tags or scripts before processing them with 'node-marked'. This can be done using libraries like DOMPurify or similar sanitization tools.
Conclusion
The 'node-marked' package has a critical vulnerability that can lead to XSS attacks if not addressed. It is essential for developers to update to the patched version and consider implementing additional sanitization measures to protect their applications. Utilizing tools like Vulert can help in monitoring and managing such vulnerabilities effectively.
See every vulnerability recorded for node-marked →
FAQ
The 'node-marked' package is a Markdown parser for Node.js that converts Markdown text into HTML, widely used in web applications.
The vulnerability allows attackers to perform cross-site scripting (XSS) attacks by injecting malicious scripts through vbscript tags in links.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Failure to fix this vulnerability can lead to XSS attacks, compromising user data and potentially allowing attackers to take control of user sessions.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for node-marked.
