Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Vulnerability 812 in marked dependency

See original GitHub issue

Expected Behavior

npm audit should succeed

Actual Behavior

┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Moderate      │ Regular Expression Denial of Service                         │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ marked                                                       │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=0.6.2                                                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ contentful-cli                                               │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ contentful-cli > markdown-cli > marked                       │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://npmjs.com/advisories/812                             │
└───────────────┴──────────────────────────────────────────────────────────────┘

Possible Solution

Upgrade markdown-cli / marked dependency.

Issue Analytics

State:
Created 4 years ago
Comments:5 (2 by maintainers)

Top GitHub Comments

2reactions

jroehlcommented, Oct 1, 2019

This will be fixed in the next release of the CLI

1reaction

peabnuts123commented, Dec 11, 2019

Still seeing this on contentful-cli@1.2.2 – did this actually get resolved? markdown-cli seems to be a totally abandoned package that is never going to upgrade its dependencies. Can it be replaced with something else? CC @jroehl

Top Results From Across the Web

Mining Node.js Vulnerabilities via Object Dependence Graph ...

The key insight of ODG is to rep- resent JavaScript objects as nodes and the relations among objects and between objects and AST...

Marked ReDoS due to email addresses being evaluated in ...

Versions of `marked` from 0.3.14 until 0.6.2 are vulnerable to Regular Expression Denial of Service. ... https://www.npmjs.com/advisories/812.

A unified framework for addiction: Vulnerabilities in the ... - NCBI

The identification of addiction as vulnerabilities in the biological decision-making system ... 1997; Koob & Le Moal 2006; Marks et al. ... 2005;25:790–812....

SySeVR: A Framework for Using Deep Learning to Detect ...

This calls for machine learning methods for vulnerability detection. ... information induced by data dependency; (iii) it considers.

Fuzzing with Data Dependency Information - S3 @ Eurecom

72 different vulnerabilities that our data-dependency driven approach can identify when executed on 38 target programs.