Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

WS-2019-0209 (Medium) detected in marked-0.6.2.tgz #5

Open
mend-for-github-com bot opened this issue Aug 12, 2021 · 0 comments
Open

WS-2019-0209 (Medium) detected in marked-0.6.2.tgz #5

mend-for-github-com bot opened this issue Aug 12, 2021 · 0 comments

Comments

@mend-for-github-com
Copy link

WS-2019-0209 - Medium Severity Vulnerability

Vulnerable Library - marked-0.6.2.tgz

A markdown parser built for speed

Library home page: https://registry.npmjs.org/marked/-/marked-0.6.2.tgz

Path to dependency file: picasso/package.json

Path to vulnerable library: picasso/node_modules/marked

Dependency Hierarchy:

  • react-storybook-addon-chapters-3.1.7.tgz (Root Library)
    • marksy-2.0.1.tgz
      • ❌ marked-0.6.2.tgz (Vulnerable Library)

Found in HEAD commit: 53a94a03136ecb8f16dab00c4f66c6eeb1bbcbbc

Vulnerability Details

marked before 0.7.0 vulnerable to Redos attack by he _label subrule that may significantly degrade parsing performance of malformed input.

Publish Date: 2019-07-04

URL: WS-2019-0209

CVSS 2 Score Details (5.0)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/1076

Release Date: 2019-09-05

Fix Resolution: 0.7.0
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
0 participants