Versions 0.3.2 and earlier of marked are affected by a cross-site scripting vulnerability even when sanitize:true is set.
[xss link](vbscript:alert(1))
will get a link
<a href="vbscript:alert(1)">xss link</a>
Update to version 0.3.3 or later.
| Score | Percentile |
|---|---|
| 0.35% | 56.77% |
No CVSS scores in this advisory.
| Type | Value |
|---|---|
| GHSA | GHSA-cfjh-p3g4-3q2f ↗ |
| CVE | CVE-2015-1370 ↗ |
| CWE id | Name |
|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
Vulnerable version ranges and first patched releases as published by GitHub.
| Ecosystem | Package | Vulnerable range | First patched | Vulnerable functions |
|---|---|---|---|---|
| npm | marked | < 0.3.3 | 0.3.3 | — |