CVE-2015-1370
Incomplete blacklist vulnerability in marked 0.3.2 and earlier for Node.js allows remote attackers to conduct cross-site scripting (XSS) attacks via a vbscript tag in a link.
- EPSS
- 2.0% chance of exploitation in the next 30 days; higher than 81% of CVEs (scores of 2026-10-31)
- Published
- Modified
- Record from
- the NVD, synced
Affected
- marked_project:marked
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-cfjh-p3g4-3q2f | npm | marked | <0.3.3 | 0.3.3 |