GHSA-vfvf-mqq8-rwqc
GitHub Security Advisory
Sanitization bypass using HTML Entities in marked
✓ GitHub Reviewed
MODERATE
Has CVE
Advisory Details
Affected versions of `marked` are susceptible to a cross-site scripting vulnerability in link components when `sanitize:true` is configured.
## Proof of Concept
This flaw exists because link URIs containing HTML entities get processed in an abnormal manner. Any HTML Entities get parsed on a best-effort basis and included in the resulting link, while if that parsing fails that character is omitted.
For example:
A link URI such as
```
javascript֍ocument;alert(1)
```
Renders a valid link that when clicked will execute `alert(1)`.
## Recommendation
Update to version 0.3.6 or later.
Affected Packages
npm
marked
Affected versions:
0
(fixed in 0.3.6)
Related CVEs
Key Information
5.0
/10
Dataset
Last updated: July 3, 2025 6:26 AM
Data from GitHub Advisory Database. This information is provided for research and educational purposes.