CVE-2021-21306: Denial of Service in Marked
Marked is an open-source markdown parser and compiler (npm package "marked"). In marked from version 1.1.1 and before version 2.0.0, there is a Regular expression Denial of Service vulnerability. This vulnerability can affect anyone who runs user generated code through marked. This vulnerability is fixed in version 2.0.0.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2021-21306?
CVE-2021-21306 is considered a moderate severity vulnerability due to its potential to cause Denial of Service through regular expressions.
How do I fix CVE-2021-21306?
To fix CVE-2021-21306, upgrade the marked npm package to version 2.0.0 or later.
Who is affected by CVE-2021-21306?
CVE-2021-21306 affects any application running user-generated code through versions of marked between 1.1.1 and before 2.0.0.
What type of vulnerability is CVE-2021-21306?
CVE-2021-21306 is classified as a Regular expression Denial of Service (ReDoS) vulnerability.
When was CVE-2021-21306 discovered?
CVE-2021-21306 was disclosed in early 2021.