CVE-2016-10531

Vulnerability

In marked versions before 0.3.6, the unescape function used a regex /(&#[\w]+);/g that matched HTML entity references but did not require a terminating semicolon. This enabled crafted input like &#x58anything; to be partially parsed into a colon and leave the remainder anything; in the output. When used with sanitize: true, the sanitizer could be bypassed, allowing injection of javascript: URIs into links [1][2].

Exploitation

An attacker needs only the ability to provide markdown input to a marked instance with sanitize: true enabled. No authentication or special network position is required if the service is public. For example, input such as `link) would be rendered as a valid link because the HTML entity &#x58 becomes a colon and &#40 becomes an opening parenthesis, while the remaining document; and alert parts are left intact, resulting in a javascript:` URL that executes when clicked [2][3].

Impact

Successful exploitation results in cross-site scripting (XSS). An attacker can execute arbitrary JavaScript in the context of the victim's browser, leading to session theft, data exfiltration, or other actions on behalf of the user. The user must click on the crafted link for the attack to trigger [2].

Mitigation

Update to marked version 0.3.6 or later, released on September 15, 2015 [2][3]. The fix tightens the regex for unescaping HTML entities to require an optional semicolon and properly handle all entity forms. No known workarounds exist for earlier versions; switching to a maintained library is recommended for unpatched deployments.