CVE-2018-25110

Katalog CVE

CVSS 7.5 · High EPSS 0,59%

Kerentanan Inefficient Regular Expression Complexity pada marked project marked. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

Marked prior to version 0.3.17 is vulnerable to a Regular Expression Denial of Service (ReDoS) attack due to catastrophic backtracking in several regular expressions used for parsing HTML tags and markdown links. An attacker can exploit this vulnerability by providing specially crafted markdown input, such as deeply nested or repetitively structured brackets or tag attributes, which cause the parser to hang and lead to a Denial of Service.

Rincian

Terbit di NVD

23 Mei 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-1333: Inefficient Regular Expression Complexity

EPSS (30 hari)

0,59% peluang dieksploitasi; lebih tinggi dari 46,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/markedjs/marked/commit/20bfc106013ed45713a21672ad4a34df94dcd485 patch
• https://github.com/markedjs/marked/pull/1083 issue tracking · patch
• https://github.com/Checkmarx/Vulnerabilities-Proofs-of-Concept/tree/main/2018/CVE-2018-25110 exploit · advisory pihak ketiga
• https://github.com/markedjs/marked/issues/1070 issue tracking · advisory pihak ketiga