Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2018-25110

Marked prior to version 0.3.17 is vulnerable to a Regular Expression Denial of Service (ReDoS) attack due to catastrophic backtracking in several regular expressions used for parsing HTML tags and markdown links. An attacker can exploit this vulnerability by providing specially crafted markdown input, such as deeply nested or repetitively structured brackets or tag attributes, which cause the parser to hang and lead to a Denial of Service.

Published

2025-05-23T15:15:20.210

Last Modified

2025-08-13T15:42:28.887

Status

Analyzed

Source

596c5446-0ce5-4ba2-aa66-48b3b757a647

Severity

CVSSv3.1: 7.5 (HIGH)

Weaknesses

Type: Secondary
CWE-1333

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	marked_project	marked	< 0.3.17	Yes

References

https://github.com/Checkmarx/Vulnerabilities-Proofs-of-Concept/tree/main/2018/CVE-2018-25110 Exploit, Third Party Advisory (596c5446-0ce5-4ba2-aa66-48b3b757a647)
https://github.com/markedjs/marked/commit/20bfc106013ed45713a21672ad4a34df94dcd485 Patch (596c5446-0ce5-4ba2-aa66-48b3b757a647)
https://github.com/markedjs/marked/issues/1070 Issue Tracking, Third Party Advisory (596c5446-0ce5-4ba2-aa66-48b3b757a647)
https://github.com/markedjs/marked/pull/1083 Issue Tracking, Patch (596c5446-0ce5-4ba2-aa66-48b3b757a647)