CVE-2016-10531: XSS
Affected versions of marked are susceptible to a cross-site scripting vulnerability in link components when sanitize:true is configured.
Proof of Concept
This flaw exists because link URIs containing HTML entities get processed in an abnormal manner. Any HTML Entities get parsed on a best-effort basis and included in the resulting link, while if that parsing fails that character is omitted.
For example:
A link URI such as javascript֍ocument;alert(1) Renders a valid link that when clicked will execute alert(1).
Recommendation
Update to version 0.3.6 or later.
Other sources
marked is an application that is meant to parse and compile markdown. Due to the way that marked 0.3.5 and earlier parses input, specifically HTML entities, it's possible to bypass marked's content injection protection (sanitize: true) to inject a javascript: URL. This flaw exists because &#xNNanything; gets parsed to what it could and leaves the rest behind, resulting in just anything; being left.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2016-10531?
CVE-2016-10531 is classified as a high severity cross-site scripting vulnerability.
How do I fix CVE-2016-10531?
To fix CVE-2016-10531, upgrade the 'marked' package to version 0.3.7 or later.
What versions of marked are affected by CVE-2016-10531?
CVE-2016-10531 affects marked versions up to and including 0.3.6.
What happens if I do not address CVE-2016-10531?
If left unaddressed, CVE-2016-10531 could allow attackers to execute arbitrary JavaScript in the context of a victim's browser.
Does CVE-2016-10531 impact all environments using marked?
CVE-2016-10531 primarily impacts environments configuring marked with 'sanitize:true'.