CVE-2022-21680 Cubic catastrophic backtracking (ReDoS) in marked

Marked is a markdown parser and compiler. Prior to version 4.0.10, the regular expression block.def may cause catastrophic backtracking against some strings and lead to a regular expression denial of service ReDoS. Anyone who runs untrusted markdown through a vulnerable version of marked and does...

CVE-2022-21681 Exponential catastrophic backtracking (ReDoS) in marked

Marked is a markdown parser and compiler. Prior to version 4.0.10, the regular expression inline.reflinkSearch may cause catastrophic backtracking against some strings and lead to a denial of service DoS. Anyone who runs untrusted markdown through a vulnerable version of marked and does not use a...

20ful (>=0.1.0 <=0.2.7), 4xx (=0.0.1) +1737 more potentially affected by CVE-2022-21670 via markdown-it (>=10.0.0 <=12.3.1)

markdown-it NPM version =10.0.0, =0.1.0, =0.11.0, =0.0.2, =3.0.1, =3.0.4, =4.4.0, =4.4.0, =4.2.2, =1.1.0, =4.4.0, =1.3.1, =3.7.1, =0.20.11-20200626053054, =0.20.11-20200626053054, =0.22.3-20211027074636 and more Source cves: CVE-2022-21670 Source advisory: OSV:GHSA-6VFC-QV3F-VR6C...

GHSA-6VFC-QV3F-VR6C Uncontrolled Resource Consumption in markdown-it

Impact Special patterns with length 50K chars can slow down parser significantly. js const md = require'markdown-it'; md.renderx $' '.repeat150000 x \nx; Patches Upgrade to v12.3.2+ Workarounds No. References Fix + test sample:...

Uncontrolled Resource Consumption in markdown-it

Impact Special patterns with length 50K chars can slow down parser significantly. js const md = require'markdown-it'; md.renderx $' '.repeat150000 x \nx; Patches Upgrade to v12.3.2+ Workarounds No. References Fix + test sample:...

Weseek growi 安全漏洞

Weseek Growi is an open source wiki system that can be written in Markdown by the Japanese company Weseek. Weseek growi suffers from a security vulnerability that allows an attacker to bypass authorization with a user-controlled key...

CVE-2022-21670

markdown-it is a Markdown parser. Prior to version 1.3.2, special patterns with length greater than 50 thousand characterss could slow down the parser significantly. Users should upgrade to version 12.3.2 to receive a patch. There are no known workarounds aside from upgrading...

DEBIAN-CVE-2022-21670

markdown-it is a Markdown parser. Prior to version 1.3.2, special patterns with length greater than 50 thousand characterss could slow down the parser significantly. Users should upgrade to version 12.3.2 to receive a patch. There are no known workarounds aside from upgrading...

Code injection

markdown-it is a Markdown parser. Prior to version 1.3.2, special patterns with length greater than 50 thousand characterss could slow down the parser significantly. Users should upgrade to version 12.3.2 to receive a patch. There are no known workarounds aside from upgrading...

CVE-2022-21670

markdown-it is a Markdown parser. Prior to version 1.3.2, special patterns with length greater than 50 thousand characterss could slow down the parser significantly. Users should upgrade to version 12.3.2 to receive a patch. There are no known workarounds aside from upgrading...

UBUNTU-CVE-2022-21670

markdown-it is a Markdown parser. Prior to version 1.3.2, special patterns with length greater than 50 thousand characterss could slow down the parser significantly. Users should upgrade to version 12.3.2 to receive a patch. There are no known workarounds aside from upgrading...

CVE-2022-21670

markdown-it is a Markdown parser. Prior to version 1.3.2, special patterns with length greater than 50 thousand characterss could slow down the parser significantly. Users should upgrade to version 12.3.2 to receive a patch. There are no known workarounds aside from upgrading...

CVE-2022-21670 Uncontrolled Resource Consumption in markdown-it

markdown-it is a Markdown parser. Prior to version 1.3.2, special patterns with length greater than 50 thousand characterss could slow down the parser significantly. Users should upgrade to version 12.3.2 to receive a patch. There are no known workarounds aside from upgrading...

CVE-2022-21670

CVE-2022-21670 affects the markdown-it Markdown parser. The vulnerability arises from handling of special patterns with length over 50,000 characters, which can cause significant slowdown (denial of service) in affected versions. The issue is addressed by upgrading to version 12.3.2 ; there are n...

CVE-2022-21670 Uncontrolled Resource Consumption in markdown-it

markdown-it is a Markdown parser. Prior to version 1.3.2, special patterns with length greater than 50 thousand characterss could slow down the parser significantly. Users should upgrade to version 12.3.2 to receive a patch. There are no known workarounds aside from upgrading...

Markdown-It 资源管理错误漏洞

Markdown-It is a Markdown parser. A security vulnerability exists in Markdown-It, which originates from Markdown-It is a Markdown parser. Prior to version 1.3.2, special patterns greater than 50,000 characters in length significantly slowed down the parser. Users should upgrade to version 12.3.2 ...

PT-2022-15024 · Unknown · Markdown-It

Name of the Vulnerable Software and Affected Versions: markdown-it versions prior to 12.3.2 Description: The issue concerns a Markdown parser that can be significantly slowed down by special patterns with lengths greater than 50 thousand characters. There are no known real-world incidents or...

Design/Logic Flaw

Mermaid is a Javascript based diagramming and charting tool that uses Markdown-inspired text definitions and a renderer to create and modify complex diagrams. Prior to version 8.13.8, malicious diagrams can run javascript code at diagram readers' machines. Users should upgrade to version 8.13.8 t...

CVE-2021-43861

CVE-2021-43861 affects Mermaid (JavaScript diagramming tool). The vulnerability occurs in versions prior to 8.13.8 where crafted diagrams can execute JavaScript on readers’ machines. The advisory/records in connected documents confirm the issue, its impact, and the remediation: upgrade Mermaid to...

CVE-2021-43861 Incorrect sanitisation function leads to `XSS`

Mermaid is a Javascript based diagramming and charting tool that uses Markdown-inspired text definitions and a renderer to create and modify complex diagrams. Prior to version 8.13.8, malicious diagrams can run javascript code at diagram readers' machines. Users should upgrade to version 8.13.8 t...