CVE-2016-10531

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

marked is an application that is meant to parse and compile markdown. Due to the way that marked 0.3.5 and earlier parses input, specifically HTML entities, it's possible to bypass marked's content injection protection (`sanitize: true`) to inject a `javascript:` URL. This flaw exists because `&#xNNanything;` gets parsed to what it could and leaves the rest behind, resulting in just `anything;` being left.

Metrics

CVSS 3.0 6.1/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
HackerOne	marked node module	<=0.3.5

References

https://github.com/chjj/marked/pull/592Exploit, Issue Tracking, Third Party Advisory
https://github.com/chjj/marked/pull/592/commits/2cff85979be8e7a026a9aca35542c470cf5da523Patch, Third Party Advisory
https://nodesecurity.io/advisories/101Third Party Advisory
https://github.com/chjj/marked/pull/592Exploit, Issue Tracking, Third Party Advisory
https://github.com/chjj/marked/pull/592/commits/2cff85979be8e7a026a9aca35542c470cf5da523Patch, Third Party Advisory
https://nodesecurity.io/advisories/101Third Party Advisory

Timeline

Published: May 31, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-105329.8console-io is a module that allows users to implement a web console in their application. A malicious user could bypass the authentication a CVE-2016-105338.8express-restify-mongoose is a module to easily create a flexible REST interface for mongoose models. express-restify-mongoose 2.4.2 and earl CVE-2016-105345.9electron-packager is a command line tool that packages Electron source code into `.app` and `.exe` packages. along with Electron. The `--str CVE-2016-105355.9csrf-lite is a cross-site request forgery protection library for framework-less node sites. csrf-lite uses `===`, a fail first string compar CVE-2016-105365.9engine.io-client is the client for engine.io, the implementation of a transport-based cross-browser/cross-device bi-directional communicatio CVE-2016-105375.4backbone is a module that adds in structure to a JavaScript heavy application through key-value pairs and custom events connecting to your R CVE-2016-105383.5The package `node-cli` before 1.0.0 insecurely uses the lock_file and log_file. Both of these are temporary, but it allows the starting user CVE-2016-105397.5negotiator is an HTTP content negotiator for Node.js and is used by many modules and frameworks including Express and Koa. The header for "A CVE-2016-10549.8Use-after-free vulnerability in Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acro CVE-2016-105407.5Minimatch is a minimal matching utility that works by converting glob expressions into JavaScript `RegExp` objects. The primary function, `m CVE-2016-105419.8The npm module "shell-quote" 1.6.0 and earlier cannot correctly escape ">" and "<" operator used for redirection in shell. Applications that CVE-2016-105427.5ws is a "simple to use, blazing fast and thoroughly tested websocket client, server and console for node.js, up-to-date against RFC-6455". B