CVE-2018-25110CWE-1333

Regular Expression Denial of Service (ReDoS) in markedjs/marked

Medium · published May 23, 2025

CVSS v4.0
6.9
EPSS
1%
Percentile
48.3
In the wild
Unconfirmed
What it is

Marked prior to version 0.3.17 is vulnerable to a Regular Expression Denial of Service (ReDoS) attack due to catastrophic backtracking in several regular expressions used for parsing HTML tags and markdown links. An attacker can exploit this vulnerability by providing specially crafted markdown input, such as deeply nested or repetitively structured brackets or tag attributes, which cause the parser to hang and lead to a Denial of Service.

The record
Technical detail
CVSS v4.0
6.9 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
EPSS
0.00610 · 48.3th percentile
Weakness
CWE-1333 · Inefficient Regular Expression Complexity
Published
2025-05-23T14:53Z
EPSS history
Timeline
  • 23 MAY 14:53Z
    Regular Expression Denial of Service (ReDoS) in markedjs/marked
    cvelistv5