Marked prior to version 0.3.17 is vulnerable to a Regular Expression Denial of Service (ReDoS) attack due to catastrophic backtracking in several regular expressions used for parsing HTML tags and markdown links. An attacker can exploit this vulnerability by providing specially crafted markdown input, such as deeply nested or repetitively structured brackets or tag attributes, which cause the parser to hang and lead to a Denial of Service.
References
| Link | Resource |
|---|---|
| https://github.com/Checkmarx/Vulnerabilities-Proofs-of-Concept/tree/main/2018/CVE-2018-25110 | Exploit Third Party Advisory |
| https://github.com/markedjs/marked/commit/20bfc106013ed45713a21672ad4a34df94dcd485 | Patch |
| https://github.com/markedjs/marked/issues/1070 | Issue Tracking Third Party Advisory |
| https://github.com/markedjs/marked/pull/1083 | Issue Tracking Patch |
Configurations
History
13 Aug 2025, 15:42
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:marked_project:marked:*:*:*:*:*:node.js:*:* | |
| References | () https://github.com/markedjs/marked/pull/1083 - Issue Tracking, Patch | |
| References | () https://github.com/markedjs/marked/commit/20bfc106013ed45713a21672ad4a34df94dcd485 - Patch | |
| References | () https://github.com/Checkmarx/Vulnerabilities-Proofs-of-Concept/tree/main/2018/CVE-2018-25110 - Exploit, Third Party Advisory | |
| References | () https://github.com/markedjs/marked/issues/1070 - Issue Tracking, Third Party Advisory | |
| First Time |
Marked Project marked
Marked Project |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.5 |
23 May 2025, 15:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-05-23 15:15
Updated : 2025-08-13 15:42
NVD link : CVE-2018-25110
Mitre link : CVE-2018-25110
JSON object : View
Products Affected
marked_project
- marked
CWE
No CWE.