Content Injection Vulnerability in node-marked Package
Summary
DEBIAN-CVE-2016-10531: marked is an application that is meant to parse and compile markdown. Affects node-marked versions < 0.3.6+dfsg-1. Fixed in 0.3.6+dfsg-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The node-marked package is a popular application designed to parse and compile Markdown, a lightweight markup language. It is widely used in web applications to convert Markdown text into HTML. The package provides features such as sanitization options to prevent content injection attacks. However, certain versions of node-marked are vulnerable to a specific flaw that allows attackers to bypass these protections.
Vulnerability Detail
The vulnerability arises from the way node-marked versions 0.3.5 and earlier handle HTML entities during parsing. Specifically, the parser fails to properly sanitize input when it encounters certain HTML entities, allowing an attacker to inject a 'javascript:' URL. This can lead to potential security risks, including cross-site scripting (XSS) attacks, where malicious scripts are executed in the context of a user's browser.
How To Fix
Minimum fixed version
0.3.6+dfsg-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade node-markedTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can disable the sanitization feature in node-marked, but this is not recommended as it exposes your application to potential security risks. Instead, ensure that you update to the patched version as soon as possible.
Conclusion
The node-marked package has a critical vulnerability that allows for content injection due to improper handling of HTML entities. It is essential to update to the latest version to protect your application from potential attacks. Utilizing tools like Vulert can help monitor vulnerabilities in real-time.
See every vulnerability recorded for node-marked →
FAQ
node-marked is a JavaScript library used to parse and compile Markdown into HTML.
Versions 0.3.5 and earlier of node-marked are affected by this vulnerability.
Exploiting this vulnerability can lead to content injection attacks, including cross-site scripting (XSS), which can compromise user data and application integrity.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without any signup.
While the best solution is to update to the patched version, you can temporarily disable the sanitization feature, but this is not recommended due to security risks.
References
Related vulnerabilities
Recent vulnerabilities recorded for node-marked.
