Denial of Service Vulnerability in Node-marked Package: CVE-2018-25110
Summary
UBUNTU-CVE-2018-25110: Marked prior to version 0.3.17 is vulnerable to a Regular Expression Denial of Service (ReDoS) attack due to catastrophic backtracking in several regular expressions used for parsing HTML tags and markdown links. Affects node-marked versions 0.3.2+dfsg-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node-marked is a JavaScript library used for parsing and converting markdown into HTML. It is widely utilized in various applications to render markdown content efficiently. However, prior to version 0.3.17, Node-marked is susceptible to a Regular Expression Denial of Service (ReDoS) attack, which can severely impact the performance and availability of applications relying on this package.
Vulnerability Detail
The vulnerability arises from catastrophic backtracking in several regular expressions used for parsing HTML tags and markdown links. An attacker can exploit this by providing specially crafted markdown input, such as deeply nested or repetitively structured brackets or tag attributes. This can cause the parser to hang, leading to a Denial of Service, where legitimate users are unable to access the application.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can sanitize the markdown input to prevent deeply nested structures or limit the complexity of markdown content processed by the application. This can be done by implementing input validation checks before passing the content to the Node-marked parser.
Conclusion
In summary, the CVE-2018-25110 vulnerability in the Node-marked package poses a significant risk of Denial of Service due to improper handling of markdown input. It is crucial to update to the latest version to ensure the security and availability of applications using this library.
See every vulnerability recorded for node-marked →
FAQ
CVE-2018-25110 is a vulnerability in the Node-marked package that allows attackers to exploit the parsing of markdown content, leading to a Denial of Service.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor for open-source vulnerabilities without requiring installation.
The primary consequence is a Denial of Service, where the application may become unresponsive, affecting user access and overall functionality.
Yes, the patched version of Node-marked is 0.3.17 or higher. It is recommended to update to this version to mitigate the vulnerability.
If immediate updating is not possible, implement input validation to limit the complexity of markdown content processed by the application as a temporary measure.
Related vulnerabilities
Recent vulnerabilities recorded for node-marked.
