Marked Project maintains a markdown parser library whose vulnerability footprint, though modest in volume, carries outsized visibility due to its integration into documentation systems and content-processing pipelines. The recurring exposure centers on the Marked product and reflects resource-consumption and parsing challenges characteristic of text-processing tools, including uncontrolled resource consumption, inefficient regex complexity, cross-site scripting in output generation, and infinite-loop conditions. Current severity, exploitation activity, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Marked Project over time
Signals from CVEs in this vendor scope (11 CVEs).
11 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2026-41680HIGH Marked is a markdown parser and compiler. From 18.0.0 to 18.0.1, a critical Denial of Service (DoS) vulnerability exists in marked. By providing a specific 3-byte input sequence a | Apr 24, 2026 | 7.5 | 30 | NO | NO |
CVE-2022-21681HIGH Marked is a markdown parser and compiler. Prior to version 4.0.10, the regular expression `inline.reflinkSearch` may cause catastrophic backtracking against some strings and lead t | Jan 14, 2022 | 7.5 | 26 | NO | NO |
CVE-2022-21680HIGH Marked is a markdown parser and compiler. Prior to version 4.0.10, the regular expression `block.def` may cause catastrophic backtracking against some strings and lead to a regular | Jan 14, 2022 | 7.5 | 26 | NO | NO |
CVE-2021-21306HIGH Marked is an open-source markdown parser and compiler (npm package "marked"). In marked from version 1.1.1 and before version 2.0.0, there is a Regular expression Denial of Service | Feb 8, 2021 | 7.5 | 23 | NO | NO |
CVE-2017-16114HIGH The marked module is vulnerable to a regular expression denial of service. Based on the information published in the public issue, 1k characters can block for around 6 seconds. | Jun 7, 2018 | 7.5 | 23 | NO | NO |
CVE-2017-1000427MEDIUM marked version 0.3.6 and earlier is vulnerable to an XSS attack in the data: URI parser. | Jan 2, 2018 | 6.1 | 22 | NO | NO |
CVE-2016-10531MEDIUM marked is an application that is meant to parse and compile markdown. Due to the way that marked 0.3.5 and earlier parses input, specifically HTML entities, it's possible to bypass | May 31, 2018 | 6.1 | 21 | NO | NO |
CVE-2018-25110HIGH Marked prior to version 0.3.17 is vulnerable to a Regular Expression Denial of Service (ReDoS) attack due to catastrophic backtracking in several regular expressions used for parsi | May 23, 2025 | 7.5 | 20 | NO | NO |
CVE-2015-8854HIGH The marked package before 0.3.4 for Node.js allows attackers to cause a denial of service (CPU consumption) via unspecified vectors that trigger a "catastrophic backtracking issue | Jan 23, 2017 | 7.5 | 20 | NO | NO |
CVE-2014-3743MEDIUM Multiple cross-site scripting (XSS) vulnerabilities in the Marked module before 0.3.1 for Node.js allow remote attackers to inject arbitrary web script or HTML via vectors related | Jan 6, 2020 | 6.1 | 19 | NO | NO |
Signals from CVEs in this vendor scope (11 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Marked Project.
Media articles that mention a CVE ID that affects a product developed by Marked Project — matched by CVE ID, not by vendor name.