High severity7.5OSV Advisory· Published May 23, 2025· Updated Jun 17, 2026
CVE-2018-25110
CVE-2018-25110
Description
Marked prior to version 0.3.17 is vulnerable to a Regular Expression Denial of Service (ReDoS) attack due to catastrophic backtracking in several regular expressions used for parsing HTML tags and markdown links. An attacker can exploit this vulnerability by providing specially crafted markdown input, such as deeply nested or repetitively structured brackets or tag attributes, which cause the parser to hang and lead to a Denial of Service.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
markednpm | < 0.3.17 | 0.3.17 |
Affected products
2- Range: 0.3.14, 0.3.15, 0.3.9, …
Patches
Vulnerability mechanics
References
6- github.com/markedjs/marked/commit/20bfc106013ed45713a21672ad4a34df94dcd485nvdPatchWEB
- github.com/markedjs/marked/pull/1083nvdIssue TrackingPatchWEB
- github.com/Checkmarx/Vulnerabilities-Proofs-of-Concept/tree/main/2018/CVE-2018-25110nvdExploitThird Party AdvisoryWEB
- github.com/advisories/GHSA-p9wx-2529-fp83ghsaADVISORY
- github.com/markedjs/marked/issues/1070nvdIssue TrackingThird Party AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2018-25110ghsaADVISORY
News mentions
0No linked articles in our index yet.