Most recent entries from all

EUVD-2026-99465

fkie_cve-2014-3743

GHSA-9cw2-jqp5-7x39 — Multiple Content Injection Vulnerabilities in marked

Affected: npm: marked

Versions 0.3.0 and earlier of `marked` are affected by two cross-site scripting vulnerabilities, even when `sanitize: true` is set.

The attack vectors for this vulnerability are GFM Codeblocks and JavaScript URLs.

## Recommendation

Upgrade to version 0.3.1 or later.

gsd-2014-3743

Withdrawn: UBUNTU-CVE-2014-3743

Withdrawn by the publisher.

Affected: Ubuntu:14.04:LTS: node-marked, Ubuntu:16.04:LTS: node-marked, Ubuntu:18.04:LTS: node-marked

Multiple cross-site scripting (XSS) vulnerabilities in the Marked module before 0.3.1 for Node.js allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) gfm codeblocks (language) or (2) javascript url's. sanitize: true Even if this option is set, marked is vulnerable to content injection in multiple locations if untrusted user input is allowed to be provided into marked and that output is passed to the browser. Injection is possible in two locations * gfm codeblocks (language) * javascript url's