CVE-2018-25110
Regular Expression Denial of Service (ReDoS) in markedjs/marked
- State
- Published
- Severity
- 6.9 Medium
- Published
- May 23, 2025
- Updated
- May 23, 2025
- Reserved
- May 19, 2025
Description
Marked prior to version 0.3.17 is vulnerable to a Regular Expression Denial of Service (ReDoS) attack due to catastrophic backtracking in several regular expressions used for parsing HTML tags and markdown links. An attacker can exploit this vulnerability by providing specially crafted markdown input, such as deeply nested or repetitively structured brackets or tag attributes, which cause the parser to hang and lead to a Denial of Service.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.9 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N | Checkmarx |
Weaknesses
- CWE-1333 Inefficient Regular Expression Complexity
Affected Products
| Product | Versions |
|---|---|
marked |
|
References
- https://github.com/markedjs/marked/issues/1070issue-tracking
- https://github.com/markedjs/marked/pull/1083issue-tracking
- https://github.com/markedjs/marked/commit/20bfc106013ed45713a21672ad4a34df94dcd485patch
- https://github.com/Checkmarx/Vulnerabilities-Proofs-of-Concept/tree/main/2018/CVE-2018-25110exploit
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.