要点
- CVE-2015-8854 是影响 marked (marked project), marked 的高危 (CVSS 7.5)漏洞。
- 未来 30 天内被利用的概率（EPSS）：4.4%，高于 91.4% 的漏洞。
- 修复：升级到 0.3.4 或更高版本。
| Package | Affected versions | Patched versions |
|---|
| marked | < 0.3.4
| 0.3.4
|
| marked npm | < 0.3.4
| 0.3.4
|
Description
Versions 0.3.3 and earlier of marked are affected by a regular expression denial of service ( ReDoS ) vulnerability when passed inputs that reach the em inline rule.
Recommendation
Update to version 0.3.4 or later.
NVD description
The marked package before 0.3.4 for Node.js allows attackers to cause a denial of service (CPU consumption) via unspecified vectors that trigger a "catastrophic backtracking issue for the em inline rule," aka a "regular expression denial of service (ReDoS)."
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free