CVE-2017-1000427: Marked vulnerable to XSS from data URIs – CVSS 6.1 · Watchpost

← All vulnerabilities

Marked vulnerable to XSS from data URIs

中危 6.1CVE-2017-1000427 · GHSA-7px7-7xjx-hxm8 · Published 02/01/2018 · updated 17/06/2026

要点

CVE-2017-1000427 是影响 marked (marked project), marked 的中危 (CVSS 6.1)漏洞。
未来 30 天内被利用的概率（EPSS）：1.5%，高于 74.5% 的漏洞。
修复：升级到 0.3.7 或更高版本。

Package	Affected versions	Patched versions
marked marked_project	`≤ 0.3.6`	No fix yet
marked npm	`< 0.3.7`	`0.3.7`

Description

marked version 0.3.6 and earlier is vulnerable to an XSS attack in the data: URI parser.

NVD description

marked version 0.3.6 and earlier is vulnerable to an XSS attack in the data: URI parser.

References

nvd.nist.gov/vuln/detail/CVE-2017-1000427 · ADVISORY
GitHub Advisory GHSA-7px7-7xjx-hxm8 · ADVISORY
markedjs/marked · PACKAGE
lists.fedoraproject.org/archives/list/[email protected]/message/BO2RMVVZVV6NFTU46B5RYRK7ZCXYARZS · WEB
lists.fedoraproject.org/archives/list/[email protected]/message/M6BJG6RGDH7ZWVVAUFBFI5L32RSMQN2S · WEB
snyk.io/vuln/npm:marked:20170112 · WEB
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BO2RMVVZVV6NFTU46B5RYRK7ZCXYARZS
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M6BJG6RGDH7ZWVVAUFBFI5L32RSMQN2S

marked 的其他漏洞

查看全部 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free