https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-09-29T16:52:50.654671+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cve-2015-1370 CVE-2015-1370 2026-09-29T16:52:50.675801+00:00

Incomplete blacklist vulnerability in marked 0.3.2 and earlier for Node.js allows remote attackers to conduct cross-site scripting (XSS) attacks via a vbscript tag in a link.

 https://vulnerability.circl.lu/vuln/ghsa-cfjh-p3g4-3q2f GHSA-cfjh-p3g4-3q2f — VBScript Content Injection in marked 2026-09-29T16:52:50.675899+00:00

Affected: npm: marked

Versions 0.3.2 and earlier of `marked` are affected by a cross-site scripting vulnerability even when `sanitize:true` is set.

## Proof of Concept ( IE10 Compatibility Mode Only )

`[xss link](vbscript:alert(1))`

will get a link

`<a href="vbscript:alert(1)">xss link</a>`

## Recommendation

Update to version 0.3.3 or later.