En resumen
- CVE-2015-8854 es una vulnerabilidad ALTO (CVSS 7.5) que afecta a marked (marked project), marked.
- Probabilidad de explotación en los próximos 30 días (EPSS): 4.4%, mayor que el 91.4% de las vulnerabilidades.
- Solución: actualizar a 0.3.4 o posterior.
| Package | Affected versions | Patched versions |
|---|
| marked | < 0.3.4
| 0.3.4
|
| marked npm | < 0.3.4
| 0.3.4
|
Description
Versions 0.3.3 and earlier of marked are affected by a regular expression denial of service ( ReDoS ) vulnerability when passed inputs that reach the em inline rule.
Recommendation
Update to version 0.3.4 or later.
NVD description
The marked package before 0.3.4 for Node.js allows attackers to cause a denial of service (CPU consumption) via unspecified vectors that trigger a "catastrophic backtracking issue for the em inline rule," aka a "regular expression denial of service (ReDoS)."
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free