{"id":"CVE-2015-1370","aliases":["CLSA-2026-1773188128","DEBIAN-CVE-2015-1370","EUVD-2017-0217","GHSA-cfjh-p3g4-3q2f","UBUNTU-CVE-2015-1370"],"status":"published","title":"VBScript Content Injection in marked","description":"Incomplete blacklist vulnerability in marked 0.3.2 and earlier for Node.js allows remote attackers to conduct cross-site scripting (XSS) attacks via a vbscript tag in a link.","severity":{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.02042,"percentile":0.81299,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2015-01-27T17:00:00Z","modified":"2026-10-23T13:58:15Z","fixes":[{"ecosystem":"npm","package":"marked","fixed_in":["0.3.3"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"node-marked","fixed_in":["0.3.6+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"node-marked","fixed_in":["0.3.6+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"node-marked","fixed_in":["0.3.6+dfsg-1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"marked","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.3"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"marked","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.2.10-tuxcare.0"},{"fixed":"0.2.10-tuxcare.1"}]}],"versions":["0.2.10"],"bundled":8},{"source":"osv","ecosystem":"Debian:12","package":"node-marked","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.6+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"node-marked","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.6+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"node-marked","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.6+dfsg-1"}]}]},{"source":"osv","ecosystem":"npm","package":"marked","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.3.3"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"node-marked","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.3.2+dfsg-1"]}],"products":[{"vendor":"marked_project","product":"marked"}],"references":[{"url":"https://github.com/chjj/marked/issues/492","tags":["x_refsource_MISC","x_transferred","Exploit","evidence","web","report"]},{"url":"https://nodesecurity.io/advisories/marked_vbscript_injection","tags":["x_refsource_MISC","x_transferred","Exploit","evidence","report"]},{"url":"http://www.openwall.com/lists/oss-security/2015/01/23/2","tags":["mailing-list","x_refsource_MLIST","x_transferred","web","report"]},{"url":"https://github.com/evilpacket/marked/commit/3c191144939107c45a7fa11ab6cb88be6694a1ba","tags":["x_refsource_MISC","x_transferred","fix","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-1370","tags":["advisory"]},{"url":"https://github.com/markedjs/marked/issues/492","tags":["web"]},{"url":"https://github.com/markedjs/marked/commit/fc372d1c6293267722e33f2719d57cebd67b3da1","tags":["web"]},{"url":"https://www.npmjs.com/advisories/24","tags":["web"]},{"url":"https://www.npmjs.com/advisories/24/versions","tags":["web"]},{"url":"https://github.com/advisories/GHSA-cfjh-p3g4-3q2f"},{"url":"https://security-tracker.debian.org/tracker/CVE-2015-1370","tags":["advisory"]},{"url":"https://github.com/markedjs/marked","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2015-1370","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-1370","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2015-1370","description":"Incomplete blacklist vulnerability in marked 0.3.2 and earlier for Node.js allows remote attackers to conduct cross-site scripting (XSS) attacks via a vbscript tag in a link.","status":"published","published":"2015-01-27T17:00:00Z","modified":"2024-08-06T04:40:18.574Z","updated_at":"2026-11-02T14:35:43.698357Z"}],"euvd":[{"id":"EUVD-2017-0217","description":"Incomplete blacklist vulnerability in marked 0.3.2 and earlier for Node.js allows remote attackers to conduct cross-site scripting (XSS) attacks via a vbscript tag in a link.","status":"published","published":"2015-01-27T17:00:00Z","modified":"2024-08-06T04:40:18Z","updated_at":"2026-11-03T02:22:15.605684Z"}],"ghsa":[{"id":"GHSA-cfjh-p3g4-3q2f","title":"VBScript Content Injection in marked","description":"Versions 0.3.2 and earlier of `marked` are affected by a cross-site scripting vulnerability even when `sanitize:true` is set. \n\n## Proof of Concept ( IE10 Compatibility Mode Only )\n\n`[xss link](vbscript:alert(1\u0026#41;)`\n\nwill get a link\n\n`\u003ca href=\"vbscript:alert(1)\"\u003exss link\u003c/a\u003e`\n\n\n## Recommendation\n\nUpdate to version 0.3.3 or later.","status":"published","published":"2017-10-24T18:33:36Z","modified":"2023-01-09T05:03:04Z","cwes":["CWE-79"],"updated_at":"2026-11-02T14:36:04.396827Z"}],"nvd":[{"id":"CVE-2015-1370","description":"Incomplete blacklist vulnerability in marked 0.3.2 and earlier for Node.js allows remote attackers to conduct cross-site scripting (XSS) attacks via a vbscript tag in a link.","status":"published","published":"2015-01-27T20:04:27.963Z","modified":"2026-06-17T00:22:17.067Z","cvss":[{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:03:01.643178Z"}],"osv":[{"id":"CLSA-2026-1773188128","title":"TuxCare security update for marked (8 CVEs)","description":"TuxCare rebuilt marked to address 8 CVEs. Fixed in 0.2.10-tuxcare.1.","status":"published","published":"2026-08-04T14:52:12Z","modified":"2026-10-23T13:58:15.013134856Z","updated_at":"2026-11-02T15:43:43.249928Z"},{"id":"CVE-2015-1370","description":"Incomplete blacklist vulnerability in marked 0.3.2 and earlier for Node.js allows remote attackers to conduct cross-site scripting (XSS) attacks via a vbscript tag in a link.","status":"published","published":"2015-01-27T20:04:27Z","modified":"2026-04-10T03:45:05.453599Z","updated_at":"2026-11-02T15:44:00.097545Z"},{"id":"DEBIAN-CVE-2015-1370","description":"Incomplete blacklist vulnerability in marked 0.3.2 and earlier for Node.js allows remote attackers to conduct cross-site scripting (XSS) attacks via a vbscript tag in a link.","status":"published","published":"2015-01-27T20:04:27.963Z","modified":"2026-09-09T06:47:32.343527143Z","updated_at":"2026-11-02T15:45:26.752992Z"},{"id":"GHSA-cfjh-p3g4-3q2f","title":"VBScript Content Injection in marked","description":"Versions 0.3.2 and earlier of `marked` are affected by a cross-site scripting vulnerability even when `sanitize:true` is set. \n\n## Proof of Concept ( IE10 Compatibility Mode Only )\n\n`[xss link](vbscript:alert(1\u0026#41;)`\n\nwill get a link\n\n`\u003ca href=\"vbscript:alert(1)\"\u003exss link\u003c/a\u003e`\n\n\n## Recommendation\n\nUpdate to version 0.3.3 or later.","status":"published","published":"2017-10-24T18:33:36Z","modified":"2023-11-08T03:57:49.831117Z","cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:44.927642Z"},{"id":"UBUNTU-CVE-2015-1370","description":"Incomplete blacklist vulnerability in marked 0.3.2 and earlier for Node.js allows remote attackers to conduct cross-site scripting (XSS) attacks via a vbscript tag in a link.","status":"published","published":"2015-01-27T20:04:00Z","modified":"2025-10-24T04:45:19Z","updated_at":"2026-11-02T15:54:09.721803Z"}]}}