In breve
- CVE-2015-8854 è una vulnerabilità ALTO (CVSS 7.5) che riguarda marked (marked project), marked.
- Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 4.4%, superiore al 91.4% delle vulnerabilità.
- Correzione: aggiornare a 0.3.4 o successiva.
| Package | Affected versions | Patched versions |
|---|
| marked | < 0.3.4
| 0.3.4
|
| marked npm | < 0.3.4
| 0.3.4
|
Description
Versions 0.3.3 and earlier of marked are affected by a regular expression denial of service ( ReDoS ) vulnerability when passed inputs that reach the em inline rule.
Recommendation
Update to version 0.3.4 or later.
NVD description
The marked package before 0.3.4 for Node.js allows attackers to cause a denial of service (CPU consumption) via unspecified vectors that trigger a "catastrophic backtracking issue for the em inline rule," aka a "regular expression denial of service (ReDoS)."
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free