{"id":"CVE-2014-3743","aliases":["CLSA-2026-1773188128","DEBIAN-CVE-2014-3743","EUVD-2020-0605","GHSA-9cw2-jqp5-7x39","UBUNTU-CVE-2014-3743"],"status":"published","title":"Multiple Content Injection Vulnerabilities in marked","description":"Multiple cross-site scripting (XSS) vulnerabilities in the Marked module before 0.3.1 for Node.js allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) gfm codeblocks (language) or (2) javascript url's.","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01715,"percentile":0.77576,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2020-01-06T19:41:04Z","modified":"2026-10-23T16:01:30Z","fixes":[{"ecosystem":"npm","package":"marked","fixed_in":["0.3.1"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"node-marked","fixed_in":["0.3.1+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"node-marked","fixed_in":["0.3.1+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"node-marked","fixed_in":["0.3.1+dfsg-1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"marked","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.3.0"},{"fixed":"0.3.1"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"marked","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.2.10-tuxcare.0"},{"fixed":"0.2.10-tuxcare.1"}]}],"versions":["0.2.10"],"bundled":8},{"source":"osv","ecosystem":"Debian:12","package":"node-marked","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.1+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"node-marked","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.1+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"node-marked","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.1+dfsg-1"}]}]},{"source":"osv","ecosystem":"npm","package":"marked","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.3.1"}]}]}],"products":[{"vendor":"marked_project","product":"marked"}],"references":[{"url":"https://nodesecurity.io/advisories/marked_multiple_content_injection_vulnerabilities","tags":["x_refsource_MISC","x_transferred","Broken Link","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2014/05/13/1","tags":["x_refsource_MISC","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"http://www.openwall.com/lists/oss-security/2014/05/15/2","tags":["x_refsource_MISC","x_transferred","Mailing List","Third Party Advisory","advisory","article","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-3743","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Third Party Advisory","advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-1850","tags":["advisory"]},{"url":"https://www.npmjs.com/advisories/22","tags":["web"]},{"url":"https://github.com/advisories/GHSA-9cw2-jqp5-7x39"},{"url":"https://security-tracker.debian.org/tracker/CVE-2014-3743","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2014-3743","tags":["report"]},{"url":"http://www.openwall.com/lists/oss-security/2014/05/14","tags":["report"]},{"url":"https://web.archive.org/web/20150502141648/https://nodesecurity.io/advisories/marked_multiple_content_injection_vulnerabilities","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-3743","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2014-3743","description":"Multiple cross-site scripting (XSS) vulnerabilities in the Marked module before 0.3.1 for Node.js allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) gfm codeblocks (language) or (2) javascript url's.","status":"published","published":"2020-01-06T19:41:04Z","modified":"2024-08-06T10:50:18.327Z","updated_at":"2026-11-02T14:33:44.23164Z"}],"euvd":[{"id":"EUVD-2020-0605","description":"Multiple cross-site scripting (XSS) vulnerabilities in the Marked module before 0.3.1 for Node.js allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) gfm codeblocks (language) or (2) javascript url's.","status":"published","published":"2020-01-06T19:41:04Z","modified":"2024-08-06T10:50:18Z","updated_at":"2026-11-03T01:57:09.370988Z"}],"ghsa":[{"id":"GHSA-9cw2-jqp5-7x39","title":"Multiple Content Injection Vulnerabilities in marked","description":"Versions 0.3.0 and earlier of `marked` are affected by two cross-site scripting vulnerabilities, even when `sanitize: true` is set.\n\nThe attack vectors for this vulnerability are GFM Codeblocks and JavaScript URLs.\n\n\n## Recommendation\n\nUpgrade to version 0.3.1 or later.","status":"published","published":"2020-08-31T22:52:52Z","modified":"2023-01-09T05:03:33Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:36:05.705235Z"}],"nvd":[{"id":"CVE-2014-3743","description":"Multiple cross-site scripting (XSS) vulnerabilities in the Marked module before 0.3.1 for Node.js allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) gfm codeblocks (language) or (2) javascript url's.","status":"published","published":"2020-01-06T20:15:11.697Z","modified":"2026-06-17T00:08:49.863Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:02:59.461996Z"}],"osv":[{"id":"CVE-2014-3743","description":"Multiple cross-site scripting (XSS) vulnerabilities in the Marked module before 0.3.1 for Node.js allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) gfm codeblocks (language) or (2) javascript url's.","status":"published","published":"2020-01-06T20:15:11Z","modified":"2026-04-10T03:43:50.652327Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:43:59.654289Z"},{"id":"DEBIAN-CVE-2014-3743","description":"Multiple cross-site scripting (XSS) vulnerabilities in the Marked module before 0.3.1 for Node.js allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) gfm codeblocks (language) or (2) javascript url's.","status":"published","published":"2020-01-06T20:15:11.697Z","modified":"2026-10-23T16:01:30.853895294Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:26.134753Z"},{"id":"GHSA-9cw2-jqp5-7x39","title":"Multiple Content Injection Vulnerabilities in marked","description":"Versions 0.3.0 and earlier of `marked` are affected by two cross-site scripting vulnerabilities, even when `sanitize: true` is set.\n\nThe attack vectors for this vulnerability are GFM Codeblocks and JavaScript URLs.\n\n\n## Recommendation\n\nUpgrade to version 0.3.1 or later.","status":"published","published":"2020-08-31T22:52:52Z","modified":"2023-11-08T03:57:41.045132Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:43.524801Z"},{"id":"UBUNTU-CVE-2014-3743","description":"Multiple cross-site scripting (XSS) vulnerabilities in the Marked module before 0.3.1 for Node.js allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) gfm codeblocks (language) or (2) javascript url's. sanitize: true Even if this option is set, marked is vulnerable to content injection in multiple locations if untrusted user input is allowed to be provided into marked and that output is passed to the browser. Injection is possible in two locations  * gfm codeblocks (language)  * javascript url's","status":"withdrawn","published":"2020-01-06T20:15:00Z","modified":"2025-07-16T08:11:04.969932Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:09.010095Z"},{"id":"CLSA-2026-1773188128","title":"TuxCare security update for marked (8 CVEs)","description":"TuxCare rebuilt marked to address 8 CVEs. Fixed in 0.2.10-tuxcare.1.","status":"published","published":"2026-08-04T14:52:12Z","modified":"2026-10-23T13:58:15.013134856Z","updated_at":"2026-11-02T15:43:43.249928Z"}]}}