Back to Database
Status published
Medium
CVE-2021-21306
Denial of Service in Marked
Vulnerability Description
Marked is an open-source markdown parser and compiler (npm package "marked"). In marked from version 1.1.1 and before version 2.0.0, there is a Regular expression Denial of Service vulnerability. This vulnerability can affect anyone who runs user generated code through marked. This vulnerability is fixed in version 2.0.0.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-21306
Credits & Attribution
No credits recorded in the NVD database.
References
Affected Vendor
markedjs
View all reports →Affected Software
marked
Vulnerable Versions:
>= 1.1.1, < 2.0.0
Timeline
Official Publish:
February 8th, 2021
Last Modified:
August 3rd, 2024
Added to House:
July 21st, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L