CVE-2022-21680highCWE-1333CWE-400

CVE-2022-21680: high-severity vulnerability in markedjs marked

Cubic catastrophic backtracking (ReDoS) in marked

Published · Updated

Follow this CVE+ Monitor marked+ Monitor marked

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.5epss 2.8%
In short

Marked, a markdown parser, has a flaw in its pattern-matching code that can be exploited by sending specially crafted markdown text, causing the parser to freeze or consume excessive resources and becoming unavailable to other users.

Technical detail

The regular expression in the `block.def` pattern exhibits catastrophic backtracking (ReDoS) when processing certain malicious markdown input. An attacker can send crafted markdown strings to trigger exponential regex matching time, leading to denial of service. This affects any application parsing untrusted markdown with marked versions before 4.0.10 without resource limits or worker thread isolation.

Summary generated and translated by AI from the official description.
Marked is a markdown parser and compiler. Prior to version 4.0.10, the regular expression `block.def` may cause catastrophic backtracking against some strings and lead to a regular expression denial of service (ReDoS). Anyone who runs untrusted markdown through a vulnerable version of marked and does not use a worker with a time limit may be affected. This issue is patched in version 4.0.10. As a workaround, avoid running untrusted markdown through marked or run marked on a worker thread and set a reasonable time limit to prevent draining resources.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
markedjs · marked
Related CVEs — markedjs marked

In the same product, most dangerous first.

CVE-2022-21681HIGHExponential catastrophic backtracking (ReDoS) in markedEPSS 2.7%CVE-2021-21306MEDIUMDenial of Service in MarkedEPSS 2.5%CVE-2026-41680HIGHMarked: OOM Denial of Service via Infinite Recursion in marked TokenizerEPSS 0.3%