Content Injection Vulnerability in Marked by Chjj

CVE-2016-10531

What is CVE-2016-10531?

Marked, a library designed for parsing and compiling Markdown text, has a vulnerability stemming from its handling of HTML entities in versions 0.3.5 and earlier. When input is processed with the sanitize: true option, the parser can inadvertently allow the injection of javascript: URLs. This occurs because the parser improperly handles HTML entities by discarding certain parts, potentially leaving harmful JavaScript code intact and executable. Users should ensure they are using the latest version of Marked to mitigate this security risk.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References