Skip to content
OpenAdvisories

Product · HackerOne

marked node module

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Medium 6.1
    CVE-2016-10531

    Sanitization bypass using HTML Entities in marked

    marked is an application that is meant to parse and compile markdown. Due to the way that marked 0.3.5 and earlier parses input, specifically HTML entities, it's possible to bypass marked's content injection protection (`sanitize: true`) to inject a `javascri…

    HackerOne marked node module marked node-marked Debian Ubuntu npm