CVSS 3.0
6.1 mediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NCVE-2016-10531
Medium (6.1) in marked project marked. EPSS 1.4% chance of exploitation in the next 30 days. Fixed in marked 0.3.6.
marked is an application that is meant to parse and compile markdown. Due to the way that marked 0.3.5 and earlier parses input, specifically HTML entities, it's possible to bypass marked's content injection protection (`sanitize: true`) to inject a `javascript:` URL. This flaw exists because `&#xNNanything;` gets parsed to what it could and leaves the rest behind, resulting in just `anything;` being left.
Severity
- EPSS
- 1.4% chance of exploitation in the next 30 days; higher than 73% of CVEs (scores of 2026-10-31)
- CWE
- CWE-79
- Published
- Modified
- Record from
- the NVD, synced
Affected
- marked_project:marked
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-vfvf-mqq8-rwqc | npm | marked | <0.3.6 | 0.3.6 |