Marked: Github says that marked has potential security vulnerabilities

[RusinovAnton]

Hello.
I want to inform that I see notifications about potential security vulnerabilities in https://github.com/chjj/marked which is dependency of some dependency of my library.
Here is links to vulnerabilities description:
https://nvd.nist.gov/vuln/detail/CVE-2017-1000427
https://nvd.nist.gov/vuln/detail/CVE-2017-17461

[hamzahamidi]

Does updating to the latest release fix the issue ?

[frederikprijck]

Does updating to the latest release fix the issue ?

I guess it should, as the 0.3.9 release mentions:

We think with this version we have addressed most, if not all, known security vulnerabilities. If you find more, please let us know.

[RusinovAnton]

@frederikprijck
sure some dependency haven't updated it yet. I should open issue there first. 🙄

[frederikprijck]

Yep, it looks like some packages need to update their version.

[joshbruce]

@hamzahamidi: Yes, to the best of our knowledge the XSS vulnerabilities have been fixed. However, I'm not sure what all tools exist to help us (the maintainers) verify for certain. I will defer to @matt- and @UziTech as well because I'm more the coordinator and releaser (see #956).

If any of you know how to check for certain, or how to fix other vulnerabilities we may not be aware of, please let us know or submit a PR.

I will be closing this issue for now. Please feel free to continue the conversation. And, as always, please submit PRs and issues. Thank you!

[UziTech]

As far as I know we fixed all of the open XSS vulnerabilities in v0.3.9