WS-2018-0031 | Mend Vulnerability Database

Vulnerability DatabaseWS-2018-0031

WS-2018-0031

Published:May 19, 2026

Updated:May 19, 2026

The affected versions (through 0.3.5) in marked package are vulnerable to Cross-Site Scripting (XSS) Due To Sanitization Bypass Using HTML Entities

Affected Packages

marked (CDN_JS):

Affected version(s) >=0.0.1 <0.3.6

Fix Suggestion:

Update to version 0.3.6

tensorflow (CONDA):

Affected version(s) =0.7.1 <0.8.0

Fix Suggestion:

Update to version 0.8.0

notebook (CONDA):

Affected version(s) >=4.0.1 <4.2.2

Fix Suggestion:

Update to version 4.2.2

ipython (CONDA):

Affected version(s) >=1.0.0 <4.0.0

Fix Suggestion:

Update to version 4.0.0

marked (NPM):

Affected version(s) >=0.0.1 <0.3.6

Fix Suggestion:

Update to version 0.3.6

zchat (NUGET):

Affected version(s) >=1.0.0 <=1.0.1

Fix Suggestion:

Update to version no_fix

jsdoc (NUGET):

Affected version(s) >=3.4.0 <=4.3.0

Fix Suggestion:

Update to version no_fix

polymer-core-elements (NUGET):

Affected version(s) >=0.4.2 <=0.5.5

Fix Suggestion:

Update to version no_fix

polymer-iron-elements (NUGET):

Affected version(s) =1.0.0

Fix Suggestion:

Update to version no_fix

availablelight (NUGET):

Affected version(s) =1.0.7 <1.0.8

Fix Suggestion:

Update to version 1.0.8

z4a-dotnet-scaffold (NUGET):

Affected version(s) >=1.0.0.1 <1.0.0.3

Fix Suggestion:

Update to version 1.0.0.3

angular-markdown-editor (NUGET):

Affected version(s) >=1.0.0 <=1.1.3

Fix Suggestion:

Update to version no_fix

gnap.themes.web.gnap.angular (NUGET):

Affected version(s) >=0.22.0 <=1.1.0

Fix Suggestion:

Update to version no_fix

raml.parser (NUGET):

Affected version(s) >=1.0.0 <1.0.7

Fix Suggestion:

Update to version 1.0.7

hoter/yii2-lepture-markdown (PHP):

Affected version(s) =dev-master

Fix Suggestion:

Update to version no_fix

arthurgroup/websitebuilder (PHP):

Affected version(s) =dev-tests <dev-tg

Fix Suggestion:

Update to version dev-tg

arthurgroup/websitebuilder (PHP):

Affected version(s) =1.2.x-dev <dev-1.2-test-pm

Fix Suggestion:

Update to version dev-1.2-test-pm

themewizz/twz-plugin-manager-client-library (PHP):

Affected version(s) >=dev-main <5.0.3

Fix Suggestion:

Update to version 5.0.3

etdsolutions/marked (PHP):

Affected version(s) >=dev-master <=0.3.5

Fix Suggestion:

Update to version no_fix

arthurgroup/websitebuilder (PHP):

Affected version(s) =1.1.7.x-dev <1.1.8.x-dev

Fix Suggestion:

Update to version 1.1.8.x-dev

visonforcoding/cakephp-wpadmin (PHP):

Affected version(s) >=dev-master <=0.1.4

Fix Suggestion:

Update to version no_fix

adrexia/flowchart (PHP):

Affected version(s) >=dev-false-fix-new-states <=1.0.x-dev

Fix Suggestion:

Update to version no_fix

microweber/microweber (PHP):

Affected version(s) =dev-revert-797-master

Fix Suggestion:

Update to version no_fix

microweber/microweber (PHP):

Affected version(s) =1.x-dev <1.0.x-dev

Fix Suggestion:

Update to version 1.0.x-dev

schumacherfm/markdown (PHP):

Affected version(s) >=v2.1.0-rc.3 <v2.2.0

Fix Suggestion:

Update to version v2.2.0

rcm/plugins (PHP):

Affected version(s) =dev-revert-480-master

Fix Suggestion:

Update to version no_fix

piksera/core (PHP):

Affected version(s) =dev-main

Fix Suggestion:

Update to version no_fix

reliv/rcm-plugins (PHP):

Affected version(s) =dev-revert-480-master

Fix Suggestion:

Update to version no_fix

friendsofvictoire/markdown-widget (PHP):

Affected version(s) >=dev-master <=2.1.0

Fix Suggestion:

Update to version no_fix

uikit/uikit (PHP):

Affected version(s) =2.0.0 <dev-dependabot/npm_and_yarn/dev-dependencies-32e16465c2

Fix Suggestion:

Update to version dev-dependabot/npm_and_yarn/dev-dependencies-32e16465c2

wardrobe/cabinet (PHP):

Affected version(s) =dev-master <dev-redactor

Fix Suggestion:

Update to version dev-redactor

microweber/microweber (PHP):

Affected version(s) >=dev-account-manager <oop-preview

Fix Suggestion:

Update to version oop-preview

arthurgroup/websitebuilder (PHP):

Affected version(s) =1.1.10.x-dev <1.1.11.x-dev

Fix Suggestion:

Update to version 1.1.11.x-dev

docit/core (PHP):

Affected version(s) =dev-master

Fix Suggestion:

Update to version no_fix

websix/xlsx-compiler (PHP):

Affected version(s) =dev-master <1.0.0

Fix Suggestion:

Update to version 1.0.0

tinindja/microweber-for-laravel-5.8 (PHP):

Affected version(s) >=dev-add_custom_data_on_product <oop-preview

Fix Suggestion:

Update to version oop-preview

dsheiko/extras (PHP):

Affected version(s) >=dev-master <=v1.0.3

Fix Suggestion:

Update to version no_fix

jason-munro/cypht (PHP):

Affected version(s) >=dev-bp-get-client-issue <v1.0.0-rc1

Fix Suggestion:

Update to version v1.0.0-rc1

laraporto/laraporto (PHP):

Affected version(s) >=dev-master <=1.1.x-dev

Fix Suggestion:

Update to version no_fix

siezi/phile-admin-markdown-editor (PHP):

Affected version(s) >=dev-master <=2.0.0

Fix Suggestion:

Update to version no_fix

arthurgroup/websitebuilder (PHP):

Affected version(s) =dev-unsplash_integration <dev-update_custom_fields_design

Fix Suggestion:

Update to version dev-update_custom_fields_design

20steps/bricks-demo-angularjs (PHP):

Affected version(s) =dev-master

Fix Suggestion:

Update to version no_fix

arthurgroup/websitebuilder (PHP):

Affected version(s) =dev-dependabot/composer/composer/composer-1.10.23 <dev-fix_backup_encoding_v2

Fix Suggestion:

Update to version dev-fix_backup_encoding_v2

websix/xlsx-compiler (PHP):

Affected version(s) >=1.1.0 <=1.1.3

Fix Suggestion:

Update to version no_fix

schumacherfm/markdown (PHP):

Affected version(s) >=v2.0.0 <v2.1.0-rc.1

Fix Suggestion:

Update to version v2.1.0-rc.1

ijackua/yii2-lepture-markdown-editor-widget (PHP):

Affected version(s) >=dev-master <=1.0.0

Fix Suggestion:

Update to version no_fix

filsh/footable (PHP):

Affected version(s) =dev-bs3

Fix Suggestion:

Update to version no_fix

orchestra/story (PHP):

Affected version(s) =3.1.x-dev <v3.1.0

Fix Suggestion:

Update to version v3.1.0

microweber/microweber (PHP):

Affected version(s) >=1.0.8.x-dev <1.1.x-dev

Fix Suggestion:

Update to version 1.1.x-dev

rami-awadallah/myhelpers (PHP):

Affected version(s) >=dev-master <=1.5.x-dev

Fix Suggestion:

Update to version no_fix

orchestra/story (PHP):

Affected version(s) >=v3.1.1 <3.3.x-dev

Fix Suggestion:

Update to version 3.3.x-dev

dvlpp/sharp (PHP):

Affected version(s) >=1.0.0 <v1.3.28

Fix Suggestion:

Update to version v1.3.28

speixoto/yii2-polymer (PHP):

Affected version(s) =dev-master

Fix Suggestion:

Update to version no_fix

salimkamboh/yii2-angularjs (PHP):

Affected version(s) >=dev-main <=1.0

Fix Suggestion:

Update to version no_fix

lambda/yii2-neon (PHP):

Affected version(s) >=dev-master <=0.1.1

Fix Suggestion:

Update to version no_fix

sunra/angularjs-symfony2-bundle (PHP):

Affected version(s) >=dev-master <=v1.5.5

Fix Suggestion:

Update to version no_fix

20steps/bricks-custom-acme-demo-angular-bundle (PHP):

Affected version(s) =dev-master

Fix Suggestion:

Update to version no_fix

arthurgroup/websitebuilder (PHP):

Affected version(s) >=1.0.8.x-dev <1.0.10.x-dev

Fix Suggestion:

Update to version 1.0.10.x-dev

dungphanxuan/yii2-lepture-editor (PHP):

Affected version(s) >=dev-master <=0.1

Fix Suggestion:

Update to version no_fix

arthurgroup/websitebuilder (PHP):

Affected version(s) =dev-media_library_unsplash_update <dev-newsletter_module

Fix Suggestion:

Update to version dev-newsletter_module

arthurgroup/websitebuilder (PHP):

Affected version(s) =dev-admin_mobile <dev-admin_redesign

Fix Suggestion:

Update to version dev-admin_redesign

tinindja/microweber-for-laravel-5.8 (PHP):

Affected version(s) >=1.0.8.x-dev <1.1.x-dev

Fix Suggestion:

Update to version 1.1.x-dev

microweber/microweber (PHP):

Affected version(s) >=dev-Radanovn-patch-1 <1.0.2.x-dev

Fix Suggestion:

Update to version 1.0.2.x-dev

soldotno/vanilla-enterprise-module (PHP):

Affected version(s) =dev-master <1.0

Fix Suggestion:

Update to version 1.0

ristorantino/install (PHP):

Affected version(s) =dev-ale-helpers-components <dev-master

Fix Suggestion:

Update to version dev-master

dvlpp/sharp (PHP):

Affected version(s) >=2.0.0 <2.0.4

Fix Suggestion:

Update to version 2.0.4

tinindja/microweber-for-laravel-5.8 (PHP):

Affected version(s) =dev-contact_form_fix_sr-1 <1.0.2.x-dev

Fix Suggestion:

Update to version 1.0.2.x-dev

arthurgroup/websitebuilder (PHP):

Affected version(s) =dev-contact_from_email_providers <dev-custom_field_button

Fix Suggestion:

Update to version dev-custom_field_button

greenpower/asset-bundle (PHP):

Affected version(s) =dev-develop

Fix Suggestion:

Update to version no_fix

ipython (PYTHON):

Affected version(s) >=1.0.0 <4.0.0

Fix Suggestion:

Update to version 4.0.0

notebook (PYTHON):

Affected version(s) >=4.0.1 <4.2.2

Fix Suggestion:

Update to version 4.2.2

Related Resources (3)

https://github.com/RetireJS/retire.js/commit/586b6c4371702ed853609a4451ad2b2c7984a788

https://github.com/markedjs/marked/commit/2cff85979be8e7a026a9aca35542c470cf5da523

https://github.com/markedjs/marked/pull/592

Do you need more information?

CVSS v4

Base Score:

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Attack Requirements

NONE

Privileges Required

NONE

User Interaction

PASSIVE

Vulnerable System Confidentiality

LOW

Vulnerable System Integrity

LOW

Vulnerable System Availability

LOW

Subsequent System Confidentiality

LOW

Subsequent System Integrity

LOW

Subsequent System Availability

LOW

CVSS v3

Base Score:

7.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality

LOW

Integrity

LOW

Availability

LOW