VBScript Content Injection in marked (GHSA-cfjh-p3g4-3q2f)
Published: 2017-10-24T18:33:36Z
Aliases: CVE-2015-1370
Severity: MODERATE · CWE: CWE-79

Versions 0.3.2 and earlier of `marked` are affected by a cross-site scripting vulnerability even when `sanitize:true` is set. 

## Proof of Concept ( IE10 Compatibility Mode Only )

`[xss link](vbscript:alert(1&#41;)`

will get a link

`<a href="vbscript:alert(1)">xss link</a>`


## Recommendation

Update to version 0.3.3 or later.

Affected packages:
package: ecosystem: npm
name: marked
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 0.3.3