Fluid Attacks Database

Description

VBScript Content Injection in marked Versions 0.3.2 and earlier of marked are affected by a cross-site scripting vulnerability even when sanitize:true is set.

Proof of Concept ( IE10 Compatibility Mode Only )

[xss link](vbscript:alert(1))

will get a link

<a href="vbscript:alert(1)">xss link</a>

Recommendation

Update to version 0.3.3 or later.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
debian 13	node-marked	>=0 <0.3.6+dfsg-1	0.3.6+dfsg-1
npm	marked	>=0 <0.3.3	0.3.3
debian 11	node-marked	>=0 <0.3.6+dfsg-1	0.3.6+dfsg-1
debian 12	node-marked	>=0 <0.3.6+dfsg-1	0.3.6+dfsg-1
nuget	marked	>=0 <=0.3.2	0.3.3
debian 14	node-marked	>=0 <0.3.6+dfsg-1	0.3.6+dfsg-1

Aliases

1. CVE-2015-13702. NVD-2015-13703. OSV-DEBIAN-2015-13704. OSV-2015-13705. GCVE-2015-13706. SECURITY-TRACKER-CVE-2015-1370

References

1. https://github.com/chjj/marked/issues/4922. https://github.com/markedjs/marked/issues/4923. https://github.com/evilpacket/marked/commit/3c191144939107c45a7fa11ab6cb88be6694a1ba4. https://github.com/markedjs/marked/commit/fc372d1c6293267722e33f2719d57cebd67b3da15. https://www.npmjs.com/advisories/246. https://www.npmjs.com/advisories/24/versions7. http://www.openwall.com/lists/oss-security/2015/01/23/2

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.