CVE-2022-21681: high-severity vulnerability in markedjs marked
Exponential catastrophic backtracking (ReDoS) in marked
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
Marked, a markdown parser, contains a regex flaw that can cause extreme slowdowns (ReDoS) when processing certain malicious markdown strings, potentially freezing or crashing applications that parse untrusted markdown without resource limits.
The inline.reflinkSearch regex exhibits exponential catastrophic backtracking (ReDoS) when matching specific input patterns, allowing remote denial of service against applications parsing untrusted markdown. Exploitation requires the victim to process a crafted markdown string through vulnerable marked versions prior to 4.0.10; impact is service unavailability due to CPU exhaustion.
In the same product, most dangerous first.