Content Injection Vulnerability in Marked by Chjj

CVE-2016-10531

What is CVE-2016-10531?

Marked, a library designed for parsing and compiling Markdown text, has a vulnerability stemming from its handling of HTML entities in versions 0.3.5 and earlier. When input is processed with the sanitize: true option, the parser can inadvertently allow the injection of javascript: URLs. This occurs because the parser improperly handles HTML entities by discarding certain parts, potentially leaving harmful JavaScript code intact and executable. Users should ensure they are using the latest version of Marked to mitigate this security risk.

References