CVE-2018-25110

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2018-25110
Marked prior to version 0.3.17 is vulnerable to a Regular Expression Denial of Service (ReDoS) attack due to catastrophic backtracking in several regular expressions used for parsing HTML tags and markdown links. An attacker can exploit this vulnerability by providing specially crafted markdown input, such as deeply nested or repetitively structured brackets or tag attributes, which cause the parser to hang and lead to a Denial of Service.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/Checkmarx/Vulnerabilities-Proofs-of-Concept/tree/main/2018/CVE-2018-25110 Exploit Third Party Advisory
https://github.com/markedjs/marked/commit/20bfc106013ed45713a21672ad4a34df94dcd485 Patch
https://github.com/markedjs/marked/issues/1070 Issue Tracking Third Party Advisory
https://github.com/markedjs/marked/pull/1083 Issue Tracking Patch
Configurations

Configuration 1 (hide)

cpe:2.3:a:marked_project:marked:*:*:*:*:*:node.js:*:*
History

13 Aug 2025, 15:42

Type Values Removed Values Added
CPE cpe:2.3:a:marked_project:marked:*:*:*:*:*:node.js:*:*
Summary
  • (es) Marked antes de la versión 0.3.17 es vulnerable a un ataque de denegación de servicio de expresiones regulares (ReDoS) debido a un retroceso catastrófico en varias expresiones regulares utilizadas para analizar etiquetas HTML y enlaces de Markdown. Un atacante puede explotar esta vulnerabilidad proporcionando una entrada de Markdown especialmente manipulada, como corchetes o atributos de etiqueta profundamente anidados o con estructura repetitiva, que provocan el bloqueo del analizador y provocan una denegación de servicio.
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.5
First Time Marked Project
Marked Project marked
References () https://github.com/Checkmarx/Vulnerabilities-Proofs-of-Concept/tree/main/2018/CVE-2018-25110 - () https://github.com/Checkmarx/Vulnerabilities-Proofs-of-Concept/tree/main/2018/CVE-2018-25110 - Exploit, Third Party Advisory
References () https://github.com/markedjs/marked/commit/20bfc106013ed45713a21672ad4a34df94dcd485 - () https://github.com/markedjs/marked/commit/20bfc106013ed45713a21672ad4a34df94dcd485 - Patch
References () https://github.com/markedjs/marked/issues/1070 - () https://github.com/markedjs/marked/issues/1070 - Issue Tracking, Third Party Advisory
References () https://github.com/markedjs/marked/pull/1083 - () https://github.com/markedjs/marked/pull/1083 - Issue Tracking, Patch

23 May 2025, 15:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-05-23 15:15

Updated : 2025-08-13 15:42

NVD link : CVE-2018-25110

Mitre link : CVE-2018-25110

CVE.ORG link : CVE-2018-25110

JSON object : View

Products Affected

marked_project

  • marked
CWE
CWE-1333

Inefficient Regular Expression Complexity