CVE-2022-21681: Inefficient Regular Expression Complexity

January 14, 2022 (updated November 7, 2023)

The regular expression inline.reflinkSearch may cause catastrophic backtracking against some strings and lead to a denial of service (DoS). Anyone who runs untrusted markdown through a vulnerable version of marked and does not use a worker with a time limit may be affected. This issue is patched As a workaround, avoid running untrusted markdown through marked or run marked on a worker thread and set a reasonable time limit to prevent draining resources.

References

github.com/markedjs/marked/commit/8f806573a3f6c6b7a39b8cdb66ab5ebb8d55a5f5
github.com/markedjs/marked/security/advisories/GHSA-5v2h-r2cx-5xgj
nvd.nist.gov/vuln/detail/CVE-2022-21681

Code Behaviors & Features

Detect and mitigate CVE-2022-21681 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →