Security readout for executives and security teams
Plain-English summary
Older versions of the marked Markdown parser can be forced to spend excessive CPU time processing malicious Markdown. The business risk is service slowdown or outage wherever untrusted Markdown is parsed. The sources identify a fix in marked 0.3.17, but do not show active exploitation in the wild.
Executive priority
Prioritize remediation for public-facing services, support portals, CMS features, or collaboration tools that parse user Markdown. Internal-only or trusted-input usage is lower urgency but still should be upgraded during normal dependency maintenance.
Technical view
CVE-2018-25110 is a ReDoS in marked before 0.3.17, caused by catastrophic backtracking in regexes for HTML tags and Markdown links. Attackers need only supply crafted Markdown input to trigger availability impact. CVSS v4.0 is 6.9, with low vulnerable-system availability impact.
Likely exposure
Exposure is most likely in applications that accept user-controlled Markdown and parse it with marked versions before 0.3.17. The bundle does not identify specific downstream products or deployments.
Exploitation context
The source bundle includes a public proof-of-concept reference, but KEV is false and no cited source states active exploitation. Treat this as a practical denial-of-service risk where vulnerable parsing is internet-facing or high-volume.
Researcher notes
Focus on dependency version confirmation and data-flow reachability. The affected range comes from the bundle description; the affected metadata is sparse and lists an unknown vendor. Avoid assuming impact beyond the marked package without local dependency evidence.
Mitigation direction
- Upgrade marked to version 0.3.17 or later.
- Check direct and transitive dependencies for old marked versions.
- Limit or queue untrusted Markdown parsing where immediate upgrade is delayed.
- Apply vendor guidance if package maintainers publish newer advisory details.
Validation and detection
- Review SBOMs and lockfiles for marked versions before 0.3.17.
- Map where applications parse user-supplied Markdown.
- Confirm vulnerable parsing is not reachable from public or unauthenticated inputs.
- Add regression coverage for parser timeouts and resource limits.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-1333: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2018-25110 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.9 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N——Primary CVE scoreVulnerability scoring details
Base CVSS 4.0 score
6.9MediumVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/markedjs/marked/issues/1070CVE reference · issue-tracking
- https://github.com/markedjs/marked/pull/1083CVE reference · issue-tracking
- https://github.com/markedjs/marked/commit/20bfc106013ed45713a21672ad4a34df94dcd485CVE reference · patch
- https://github.com/Checkmarx/Vulnerabilities-Proofs-of-Concept/tree/main/2018/CVE-2018-25110CVE reference · exploit
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Inefficient Regular Expression Complexity
Inefficient Regular Expression Complexity represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.