WS-2019-0027 (Medium) detected in marked-0.3.9.tgz #90
Labels
security vulnerability
Security vulnerability detected by WhiteSource
Comments
mend-for-github-com
bot
added
the
security vulnerability
This was referenced Jul 2, 2021
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
WS-2019-0027 - Medium Severity Vulnerability
A markdown parser built for speed
Library home page: https://registry.npmjs.org/marked/-/marked-0.3.9.tgz
Path to dependency file: NodeGoat/package.json
Path to vulnerable library: NodeGoat/node_modules/marked/package.json
Dependency Hierarchy:
Found in HEAD commit: d4439588ceae22fa05afef2155f4ec9819386fcf
Versions 0.3.17 and earlier of marked has Four regexes were vulnerable to catastrophic backtracking. This leaves markdown servers open to a potential REDOS attack.
Publish Date: 2018-02-26
URL: WS-2019-0027
Base Score Metrics not available
Type: Upgrade version
Origin: markedjs/marked@b15e42b
Release Date: 2019-03-17
Fix Resolution: 0.3.18
The text was updated successfully, but these errors were encountered: