Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Moderate severity vulnerability - Uncontrolled Resource Consumption in markdown-it - https://github.com/advisories/GHSA-6vfc-qv3f-vr6c

See original GitHub issue

Uncontrolled Resource Consumption in markdown-it - https://github.com/advisories/GHSA-6vfc-qv3f-vr6c fix available via npm audit fix --force Will install jsdoc-to-markdown@4.0.1, which is a breaking change node_modules/markdown-it jsdoc >=3.6.0 Depends on vulnerable versions of markdown-it node_modules/jsdoc jsdoc-api >=5.0.1 Depends on vulnerable versions of jsdoc node_modules/jsdoc-api jsdoc-to-markdown >=5.0.0-node12.1 Depends on vulnerable versions of jsdoc-api node_modules/jsdoc-to-markdown

Issue Analytics

State:
Created 2 years ago
Comments:6 (3 by maintainers)

Top GitHub Comments

2reactions

75lbcommented, Jan 29, 2022

I pushed an update refreshing the jsdoc2md dependency tree

1reaction

75lbcommented, Jan 14, 2022

despite the fact there are zero security concerns here, unfortunately npm audit still reports this offline tool as “insecure” which is irritating… the security warning is coming from this dependency in jsdoc which unfortunately I have no control over…

Someone has already reported it to jsdoc so I’ll leave this issue open until it’s resolved upstream…

Top Results From Across the Web

Uncontrolled Resource Consumption in markdown-it

Uncontrolled Resource Consumption in markdown-it. Moderate severity GitHub Reviewed Published on Jan 12 in markdown-it/markdown-it • Updated on Apr 19.

CVE-2022-21680 Detail - NVD

Anyone who runs untrusted markdown through a vulnerable version of marked and does not use a worker with a time limit may be...

Uncontrolled Resource Consumption in markdown-it

Impact Special patterns with length > 50K chars can slow down parser significantly. ```js const md = require('markdown-it')(); md.render(x ...

CWE-400: Uncontrolled Resource Consumption (4.9) - MITRE

Resource exhaustion problems are often result due to an incorrect implementation of the ... for Simplified Mapping of Published Vulnerabilities" (CWE-1003) ...

lots of vulnerability using NPM

2 Severity: moderate Uncontrolled Resource Consumption in markdown-it - https://github.com/advisories/GHSA-6vfc-qv3f-vr6c No fix available node_modules/markdown ...