Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

Marked markdown parser has a code-crashing bug

CVE-2021-21306 · published 5 years ago
Summary

Marked, a popular markdown parser, has a bug that can cause crashes when processing certain user-generated code. This could affect anyone who uses Marked to convert markdown text into HTML. Update to version 2.0.0 or later to fix the issue.

What to do
  • Update GitHub Actions marked to version 2.0.0.
  • Update marked_project marked to version 2.0.0 or later.
Affected software
Ecosystem VendorProductAffected versions
npm GitHub Actions marked >= 1.1.1, < 2.0.0
Fix: upgrade to 2.0.0
– marked_project marked >= 1.1.1, < 2.0.0
cpe:2.3:a:marked_project:marked:*:*:*:*:*:node.js:*:*
Original advisory text
Marked is an open-source markdown parser and compiler (npm package "marked"). In marked from version 1.1.1 and before version 2.0.0, there is a Regular expression Denial of Service vulnerability. T...
Marked is an open-source markdown parser and compiler (npm package "marked"). In marked from version 1.1.1 and before version 2.0.0, there is a Regular expression Denial of Service vulnerability. This vulnerability can affect anyone who runs user generated code through marked. This vulnerability is fixed in version 2.0.0.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
7.5 High
Exploitation
2% chance of attack within 30 days
Type
CWE-400Uncontrolled Resource Consumption
Timeline
Published8 Feb 2021
Updated3 Nov 2026
First seen6 Mar 2026
Sources
GHSA-4r62-v4vq-hr96 · GHSA
CVE-2021-21306 · NVD
Track software like this
Free during beta