Description
Marked is a markdown parser and compiler. Prior to version 4.0.10, the regular expression `block.def` may cause catastrophic backtracking against some strings and lead to a regular expression denial of service (ReDoS). Anyone who runs untrusted markdown through a vulnerable version of marked and does not use a worker with a time limit may be affected. This issue is patched in version 4.0.10. As a workaround, avoid running untrusted markdown through marked or run marked on a worker thread and set a reasonable time limit to prevent draining resources.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| markedjs | marked | < 4.0.10 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | node-marked | 4.0.12+ds+~4.0.1-1 | — |
| Debian 13 | node-marked | 4.0.12+ds+~4.0.1-1 | — |
| Debian 12 | node-marked | 4.0.12+ds+~4.0.1-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | node-marked | No fix yet | — |
| Ubuntu 26.04 LTS | node-marked | No fix yet | — |
| Ubuntu 25.10 | node-marked | No fix yet | — |
| Ubuntu 24.04 LTS | node-marked | No fix yet | — |
| Ubuntu 22.04 LTS | node-marked | No fix yet | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | node-marked | No fix yet | — |
| Ubuntu 18.04 LTS | node-marked | No fix yet | — |
| Ubuntu 16.04 LTS | node-marked | No fix yet | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | marked | < 4.0.10 | 4.0.10 | GHSA-rrrm-qjm4-v8hf |
Advisories 1
- WID-SEC-2023-0426 IBM Spectrum Protect: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 6, 2025