Marked_project Marked
11 CVEs affecting Marked_project Marked. Latest disclosed: 2026-04-24. Critical: 0, High: 6.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-41680 | High | 7.5 | 2026-04-24 | Marked is a markdown parser and compiler. From 18.0.0 to 18.0.1, a critical Denial of Service (DoS) vulnerability exists in marked. By providing a specific 3-b… |
CVE-2018-25110 | High | 7.5 | 2025-05-23 | Marked prior to version 0.3.17 is vulnerable to a Regular Expression Denial of Service (ReDoS) attack due to catastrophic backtracking in several regular expre… |
CVE-2022-21681 | High | 7.5 | 2022-01-14 | Marked is a markdown parser and compiler. Prior to version 4.0.10, the regular expression `inline.reflinkSearch` may cause catastrophic backtracking against so… |
CVE-2022-21680 | High | 7.5 | 2022-01-14 | Marked is a markdown parser and compiler. Prior to version 4.0.10, the regular expression `block.def` may cause catastrophic backtracking against some strings… |
CVE-2017-16114 | High | 7.5 | 2018-06-07 | The marked module is vulnerable to a regular expression denial of service. Based on the information published in the public issue, 1k characters can block for… |
CVE-2015-8854 | High | 7.5 | 2017-01-23 | The marked package before 0.3.4 for Node.js allows attackers to cause a denial of service (CPU consumption) via unspecified vectors that trigger a "catastrophi… |
CVE-2014-3743 | Medium | 6.1 | 2020-01-06 | Multiple cross-site scripting (XSS) vulnerabilities in the Marked module before 0.3.1 for Node.js allow remote attackers to inject arbitrary web script or HTML… |
CVE-2016-10531 | Medium | 6.1 | 2018-05-31 | marked is an application that is meant to parse and compile markdown. Due to the way that marked 0.3.5 and earlier parses input, specifically HTML entities, it… |
CVE-2017-1000427 | Medium | 6.1 | 2018-01-02 | marked version 0.3.6 and earlier is vulnerable to an XSS attack in the data: URI parser. |
CVE-2021-21306 | Medium | 5.3 | 2021-02-08 | Marked is an open-source markdown parser and compiler (npm package "marked"). In marked from version 1.1.1 and before version 2.0.0, there is a Regular express… |
CVE-2015-1370 | | 2015-01-27 | Incomplete blacklist vulnerability in marked 0.3.2 and earlier for Node.js allows remote attackers to conduct cross-site scripting (XSS) attacks via a vbscript… |