CVE-2022-21681

Marked is a markdown parser and compiler. Prior to version 4.0.10, the regular expression `inline.reflinkSearch` may cause catastrophic backtracking against some strings and lead to a denial of service (DoS). Anyone who runs untrusted markdown through a vulnerable version of marked and does not use a worker with a time limit may be affected. This issue is patched in version 4.0.10. As a workaround, avoid running untrusted markdown through marked or run marked on a worker thread and set a reasonable time limit to prevent draining resources.

• CWE-400
• CWE-1333
• CWE-1333

• https://github.com/markedjs/marked/commit/8f806573a3f6c6b7a39b8cdb66ab5ebb8d55a5f5Patch, Third Party Advisory
• https://github.com/markedjs/marked/security/advisories/GHSA-5v2h-r2cx-5xgjExploit, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AIXDMC3CSHYW3YWVSQOXAWLUYQHAO5UX/
• https://github.com/markedjs/marked/commit/8f806573a3f6c6b7a39b8cdb66ab5ebb8d55a5f5Patch, Third Party Advisory
• https://github.com/markedjs/marked/security/advisories/GHSA-5v2h-r2cx-5xgjExploit, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AIXDMC3CSHYW3YWVSQOXAWLUYQHAO5UX/

Published

Jan 14, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-21676Engine.IO is the implementation of transport-based cross-bro…7.5
• CVE-2022-21677Discourse is an open source discussion platform. Discourse g…5.3
• CVE-2022-21678Discourse is an open source discussion platform. Prior to ve…4.3
• CVE-2022-21679Istio is an open platform to connect, manage, and secure mic…9.8
• CVE-2022-2168The Download Manager WordPress plugin before 3.2.44 does not…6.1
• CVE-2022-21680Marked is a markdown parser and compiler. Prior to version 4…7.5
• CVE-2022-21682Flatpak is a Linux application sandboxing and distribution f…6.5
• CVE-2022-21683Wagtail is a Django based content management system focused …4.3
• CVE-2022-21684Discourse is an open source discussion platform. Versions pr…8.8
• CVE-2022-21685Frontier is Substrate's Ethereum compatibility layer. Prior …6.5
• CVE-2022-21686PrestaShop is an Open Source e-commerce platform. Starting w…9.8
• CVE-2022-21687gh-ost is a triggerless online schema migration solution for…6.5