MEDIUM🇬🇧 English

CVE-2018-25110

CVSS 6.9v4.0pub. 2025-05-23upd. 2025-08-13

Marked prior to version 0.3.17 is vulnerable to a Regular Expression Denial of Service (ReDoS) attack due to catastrophic backtracking in several regular expressions used for parsing HTML tags and markdown links. An attacker can exploit this vulnerability by providing specially crafted markdown input, such as deeply nested or repetitively structured brackets or tag attributes, which cause the parser to hang and lead to a Denial of Service.

oryginał EN
CVSS Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

  • Marked Project Marked

    APP
    Marked Project
    < 0.3.17
🔵
ZWERYFIKUJ U PRODUCENTA
Brak jednoznacznych danych o patchu. Sprawdź referencje od producenta.
Tagi
DoS
CWE
Referencje

Powiązane podatności

CVE-2026-41680HIGH8.7ten sam produkt

Marked is a markdown parser and compiler. From 18.0.0 to 18.0.1, a critical Denial of Service (DoS) vulnerabil...

CVE-2022-21680HIGH7.5ten sam produkt

Marked is a markdown parser and compiler. Prior to version 4.0.10, the regular expression `block.def` may caus...

CVE-2022-21681HIGH7.5ten sam produkt

Marked is a markdown parser and compiler. Prior to version 4.0.10, the regular expression `inline.reflinkSearc...

CVE-2017-16114HIGH7.5ten sam produkt

The marked module is vulnerable to a regular expression denial of service. Based on the information published ...

CVE-2015-8854HIGH7.5ten sam produkt

The marked package before 0.3.4 for Node.js allows attackers to cause a denial of service (CPU consumption) vi...