CVE-2016-10531

marked is an application that is meant to parse and compile markdown. Due to the way that marked 0.3.5 and earlier parses input, specifically HTML entities, it's possible to bypass marked's content injection protection (`sanitize: true`) to inject a `javascript:` URL. This flaw exists because `&#xNNanything;` gets parsed to what it could and leaves the rest behind, resulting in just `anything;` being left.
References
Link Resource
https://github.com/chjj/marked/pull/592 Exploit Issue Tracking Third Party Advisory
https://github.com/chjj/marked/pull/592/commits/2cff85979be8e7a026a9aca35542c470cf5da523 Patch Third Party Advisory
https://nodesecurity.io/advisories/101 Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:marked_project:marked:*:*:*:*:*:node.js:*:*

History

No history.

Information

Published : 2018-05-31 20:29

Updated : 2024-02-04 19:46


NVD link : CVE-2016-10531

Mitre link : CVE-2016-10531

CVE.ORG link : CVE-2016-10531


JSON object : View

Products Affected

marked_project

  • marked
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')