npm audit : "Moderate: Regular Expression Denial of Service"

[sanori]

due to the dependency of marked 0.6.1.

• https://npmjs.com/advisories/812

[tomap]

Hi, we depend on Marked ^0.6.1 => automatically updated to ^0.6.2 https://david-dm.org/hexojs/hexo-renderer-marked
Where is the issue?

[sanori]

When I run npm audit in my hexo directory, several security reports are provided.
One of the report is as follows:

┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Moderate      │ Regular Expression Denial of Service                         │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ marked                                                       │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=0.6.2                                                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ hexo-renderer-marked                                         │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ hexo-renderer-marked > marked                                │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://nodesecurity.io/advisories/812                       │
└───────────────┴──────────────────────────────────────────────────────────────┘

I agree with your assumption that npm may install updated version of marked which is fixed the problem. But, I got the above report from npm and I left this issue.

[yoshinorin]

@sanori
Thank you for your report :)
We already upgrade to marked 6.x at #87. And it's already merged into the current master branch.

But, not yet released a new version. Would you please wait a new release?
Thanks :)

[yoshinorin]

@sanori
PS. Please execute below command if you want to use the current master branch

npm install https://github.com/hexojs/hexo-renderer-markdown-it#master

[JLHwung]

A update:

hexo-renderer-marked@1.0.0 is just published, install the latest version now

npm install hexo-renderer-marked

[sanori]

I confirmed that npm install hexo-renderer-marked@1.0.0 resolved the vulnerability alert.
Thank you.