GHSA-ch52-vgq2-943f Regular Expression Denial of Service in marked
Attackers can cause denial of service in applications using the marked library by submitting malformed input that triggers excessive regex processing.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-ch52-vgq2-943f?
GHSA-ch52-vgq2-943f is a denial of service vulnerability in marked, published on 3 Sep 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Affected versions of marked are vulnerable to Regular Expression Denial of Service (ReDoS). The _label subrule may significantly degrade parsing performance of malformed input.
Recommendation
Upgrade to version 0.7.0 or later.
Which versions are affected by GHSA-ch52-vgq2-943f?
2 open source packages ship an affected version, including marked.
| Package | Affected | Fixed in |
|---|---|---|
marked npm | From 0.4.0 | 0.7.0 |
marked npm | From 0.4.0 | 0.7.0 |
How do I fix GHSA-ch52-vgq2-943f?
Upgrade marked to 0.7.0 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is GHSA-ch52-vgq2-943f being exploited?
There is no known exploitation of GHSA-ch52-vgq2-943f in the wild and no public exploit code.