https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T02:14:03.512710+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cnvd-2015-00737 cnvd-2015-00737 2026-10-03T02:14:03.516381+00:00 cnvd-2015-00737 https://cve.radiocsirt.org/vuln/euvd-2026-90208 EUVD-2026-90208 2026-10-03T02:14:03.516413+00:00 EUVD-2026-90208 https://cve.radiocsirt.org/vuln/fkie_cve-2015-1370 fkie_cve-2015-1370 2026-10-03T02:14:03.516427+00:00

Incomplete blacklist vulnerability in marked 0.3.2 and earlier for Node.js allows remote attackers to conduct cross-site scripting (XSS) attacks via a vbscript tag in a link.

 https://cve.radiocsirt.org/vuln/ghsa-cfjh-p3g4-3q2f GHSA-cfjh-p3g4-3q2f — VBScript Content Injection in marked 2026-10-03T02:14:03.516454+00:00

Affected: npm: marked

Versions 0.3.2 and earlier of `marked` are affected by a cross-site scripting vulnerability even when `sanitize:true` is set.

## Proof of Concept ( IE10 Compatibility Mode Only )

`[xss link](vbscript:alert(1))`

will get a link

`<a href="vbscript:alert(1)">xss link</a>`

## Recommendation

Update to version 0.3.3 or later.

 https://cve.radiocsirt.org/vuln/gsd-2015-1370 gsd-2015-1370 2026-10-03T02:14:03.516484+00:00 gsd-2015-1370 https://cve.radiocsirt.org/vuln/ubuntu-cve-2015-1370 UBUNTU-CVE-2015-1370 2026-10-03T02:14:03.516496+00:00

Affected: Ubuntu:16.04:LTS: node-marked

Incomplete blacklist vulnerability in marked 0.3.2 and earlier for Node.js allows remote attackers to conduct cross-site scripting (XSS) attacks via a vbscript tag in a link.