CVE-2016-10531: hackerone marked node module Cross-site Scripting
Vulnerability summary
CVE-2016-10531 is a medium (CVSS 6.1) Cross-site Scripting vulnerability in hackerone marked node module. EPSS estimates a 1.44% chance of exploitation in the next 30 days, higher than 72.7% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 0 · Duplicates 1Timeline
- 31-05-2018PublishedVulnerability first disclosed.
- 17-09-2024Last modifiedVulnerability information updated.
Description
marked is an application that is meant to parse and compile markdown. Due to the way that marked 0.3.5 and earlier parses input, specifically HTML entities, it's possible to bypass marked's content injection protection (`sanitize: true`) to inject a `javascript:` URL. This flaw exists because `&#xNNanything;` gets parsed to what it could and leaves the rest behind, resulting in just `anything;` being left.
CVSS metrics
5 scores · 4 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated6.1MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- OSV · DebianEcosystem advisory · calculated6.1MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- OSV · NpmEcosystem advisory · calculated6.1MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS trend
Probability
1.44%
Chance of exploitation in the next 30 days
Percentile
73%
Versus all other CVEs
30-day change
-0.02 pp
From 1.46% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundMarked
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Debian1 product
- node-marked< 0.3.6+dfsg-1
Hackerone1 product
- marked node module≤ 0.3.5
Marked_project1 product
- marked≤ 0.3.5
Npm1 product
- marked< 0.3.6
Ubuntu1 product
- node-markedAll versions (No fix recorded)
5 vendors · 5 products
References
9 links- github.com/chjj/marked/pull/592/commits/2cff85979be8e7a026a9aca35542c470cf5da523X Refsource MISCPatchThird Party AdvisoryREPORTWEB
