{"vulnerability": "GHSA-6VFC-QV3F-VR6C", "sightings": [{"uuid": "d594a36a-cf43-4efe-bea1-1ec21b362579", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-6VFC-QV3F-VR6C", "type": "published-proof-of-concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/12952", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2022-21670\n\ud83d\udd25 CVSS Score: 5.3 (cvssV3_1, Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)\n\ud83d\udd39 Description: markdown-it is a Markdown parser. Prior to version 1.3.2, special patterns with length greater than 50 thousand characterss could slow down the parser significantly. Users should upgrade to version 12.3.2 to receive a patch. There are no known workarounds aside from upgrading.\n\ud83d\udccf Published: 2022-01-10T20:40:10.000Z\n\ud83d\udccf Modified: 2025-04-22T18:33:46.200Z\n\ud83d\udd17 References:\n1. https://github.com/markdown-it/markdown-it/security/advisories/GHSA-6vfc-qv3f-vr6c\n2. https://github.com/markdown-it/markdown-it/commit/ffc49ab46b5b751cd2be0aabb146f2ef84986101", "creation_timestamp": "2025-04-22T19:03:48.000000Z"}, {"uuid": "d0847c1f-a462-4406-9385-606f1cb867ec", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-6vfc-qv3f-vr6c", "type": "seen", "source": "https://gist.github.com/sjl75050101-netizen/3ab4749268f0ca0bc82ea9748a2e6b25", "content": "# \u6709\u4f86\u6e90\u7684 npm \u4f9d\u8cf4\u6f0f\u6d1e\u5339\u914d\u8a66\u6a23\n\n\u9019\u662f AI \u5354\u52a9\u88fd\u4f5c\u7684\u96e2\u7dda\u5831\u544a\u5c0f\u6a23\u3002\u8f38\u5165\u662f\u660e\u793a\u865b\u69cb\u7684 npm lockfile v3\uff0c\u4e0d\u662f\u5ba2\u6236\u5c08\u6848\u3002\u4fdd\u7559\u6bcf\u500b\u5957\u4ef6\u8def\u5f91\uff0c\u53ea\u6709\u540c\u540d\u3001\u540c\u7248\u672c\u7684\u516c\u958b API \u67e5\u8a62\u6703\u53bb\u91cd\u3002\n\n\u652f\u63f4\u7bc4\u570d\u523b\u610f\u7a84\uff1a\u516c\u958b npm registry \u7684\u7cbe\u78ba\u7a69\u5b9a\u7248\uff0c\u4ee5\u53ca\u80fd\u7531 resolved \u8def\u5f91\u4e00\u81f4\u6838\u5c0d\u7684\u5957\u4ef6\u540d\u7a31\u3002workspace link\u3001Git\u4f86\u6e90\u3001\u93e1\u50cf\u3001alias\u3001\u7248\u672c\u7bc4\u570d\u6216\u7f3a\u6b04\u4f4d\u4fdd\u7559\u300c\u5c1a\u7121\u53ef\u9760\u5339\u914d\u300d\uff0c\u4e0d\u731c\u5957\u4ef6\u3002\n\n```sh\npython3 report.py fictional-package-lock.json saved-query.json report.json\n```\n\n\u6d88\u8cbb\u8005\u547d\u4ee4\u53ea\u8b80\u53d6\u5df2\u4fdd\u5b58\u7684\u67e5\u8a62\u7d50\u679c\uff1b\u4e0d\u50b3\u6a94\u3001\u4e0d\u67e5\u7db2\u8def\u3001\u4e0d\u5b89\u88dd\u6216\u5347\u7d1a\u5957\u4ef6\uff0c\u4e5f\u4e0d\u767c\u901a\u77e5\u3002\u5df2\u5b58\u5728\u7684\u8f38\u51fa\u6703\u88ab\u62d2\u7d55\u8986\u5beb\u3002\n\n2026-10-01 \u516c\u958b OSV querybatch \u4e2d\uff0cmarkdown-it 12.3.1 \u56de\u50b3\u4e09\u500b ID\u300112.3.2 \u56de\u50b3\u5169\u500b ID\u3002\u6b77\u53f2 GHSA-6vfc-qv3f-vr6c \u662f\u524d\u8005\u7684\u5339\u914d\uff0c\u5f8c\u8005\u6c92\u6709\u9019\u500b ID\uff1b**12.3.2 \u4ecd\u6709\u53e6\u5916\u5169\u500b\u5339\u914d\uff0c\u4e0d\u80fd\u7a31\u70ba\u5b89\u5168\u7248\u672c**\u3002\u53ea\u6709\u6307\u5b9a\u63a7\u5236\u6f0f\u6d1e\u7684\u8a73\u7d30\u7d00\u9304\u5df2\u6838\u5c0d\uff0c\u5176\u4ed6 ID \u4e0d\u63a8\u5b9a\u56b4\u91cd\u5ea6\u3001\u53ef\u5229\u7528\u6027\u6216\u5be6\u969b\u53ef\u9054\u6027\u3002\n\n\u300c\u6c92\u6709\u5339\u914d\u300d\u4e5f\u4e0d\u7b49\u65bc\u5b89\u5168\u3002\u5206\u9801\u3001\u56de\u61c9\u7f3a\u6f0f\u3001\u932f\u914d\u53ca\u672a\u6620\u5c04\u5957\u4ef6\u5404\u81ea\u4fdd\u7559\u672a\u77e5\uff1b\u5b8c\u6574\u6027\u4e0d\u80fd\u7531\u4e00\u500b\u7e3d\u6578\u6216\u7da0\u71c8\u66ff\u4ee3\u3002\u9396\u5b9a\u6a94\u4f86\u6e90\u4e0d\u4ee3\u8868\u5be6\u969b\u90e8\u7f72\u7684\u5957\u4ef6\u6216\u7a0b\u5f0f\u57f7\u884c\u8def\u5f91\u5df2\u9a57\u8b49\u3002\n\n\u76ee\u524d\u6c92\u6709\u5ba2\u6236\u6383\u63cf\u3001\u76e3\u63a7\u3001\u8a02\u95b1\u3001\u670d\u52d9\u50f9\u683c\u6216\u5546\u7528\u8cc7\u6599\u8f49\u552e\u8cc7\u683c\u9a57\u8b49\u3002\u73fe\u6709\u514d\u8cbb [OSV-Scanner](https://google.github.io/osv-scanner/) \u5df2\u8655\u7406\u8a31\u591a\u5b8c\u6574\u6383\u63cf\u9700\u6c42\uff1b\u5c1a\u672a\u8b49\u660e\u6b64\u7a84\u5831\u544a\u8db3\u4ee5\u8b93\u7dad\u8b77\u5718\u968a\u4ed8\u8cbb\uff0c\u4e0d\u80fd\u628a\u91cd\u65b0\u5305\u88dd\u6383\u63cf\u7576\u6536\u5165\u3002\n\n\u4f86\u6e90\uff1a[OSV querybatch](https://google.github.io/osv.dev/post-v1-querybatch/)\u3001[\u6307\u5b9a\u6b77\u53f2\u6f0f\u6d1e](https://osv.dev/vulnerability/GHSA-6vfc-qv3f-vr6c)\u3001[npm lockfile](https://docs.npmjs.com/cli/v11/configuring-npm/package-lock-json/)\u3002\u539f\u67e5\u8a62\uff0f\u56de\u61c9\u3001UTC\u3001SHA \u548c\u54c1\u8cea\u7d00\u9304\u8207\u8a66\u6a23\u4e00\u8d77\u4fdd\u5b58\u3002\n\n\n{\n  \"rows\": [\n    {\n      \"path\": \"node_modules/markdown-it\",\n      \"status\": \"matches_returned\",\n      \"reason\": null,\n      \"identity\": {\n        \"package\": {\n          \"ecosystem\": \"npm\",\n          \"name\": \"markdown-it\"\n        },\n        \"version\": \"12.3.1\"\n      },\n      \"project_safe\": \"unverified\",\n      \"reachability\": \"unverified\",\n      \"auto_upgrade\": false,\n      \"auto_notify\": false,\n      \"advisory_ids\": [\n        \"GHSA-253c-mchw-3w2r\",\n        \"GHSA-6v5v-wf23-fmfq\",\n        \"GHSA-6vfc-qv3f-vr6c\"\n      ],\n      \"query_complete\": true,\n      \"observed_at_utc\": \"2026-10-01T02:47:11.834265+00:00\",\n      \"source\": \"https://api.osv.dev/v1/querybatch\"\n    },\n    {\n      \"path\": \"node_modules/fictional-parent/node_modules/markdown-it\",\n      \"status\": \"matches_returned\",\n      \"reason\": null,\n      \"identity\": {\n        \"package\": {\n          \"ecosystem\": \"npm\",\n          \"name\": \"markdown-it\"\n        },\n        \"version\": \"12.3.1\"\n      },\n      \"project_safe\": \"unverified\",\n      \"reachability\": \"unverified\",\n      \"auto_upgrade\": false,\n      \"auto_notify\": false,\n      \"advisory_ids\": [\n        \"GHSA-253c-mchw-3w2r\",\n        \"GHSA-6v5v-wf23-fmfq\",\n        \"GHSA-6vfc-qv3f-vr6c\"\n      ],\n      \"query_complete\": true,\n      \"observed_at_utc\": \"2026-10-01T02:47:11.834265+00:00\",\n      \"source\": \"https://api.osv.dev/v1/querybatch\"\n    },\n    {\n      \"path\": \"node_modules/fictional-other/node_modules/markdown-it\",\n      \"status\": \"matches_returned\",\n      \"reason\": null,\n      \"identity\": {\n        \"package\": {\n          \"ecosystem\": \"npm\",\n          \"name\": \"markdown-it\"\n        },\n        \"version\": \"12.3.2\"\n      },\n      \"project_safe\": \"unverified\",\n      \"reachability\": \"unverified\",\n      \"auto_upgrade\": false,\n      \"auto_notify\": false,\n      \"advisory_ids\": [\n        \"GHSA-253c-mchw-3w2r\",\n        \"GHSA-6v5v-wf23-fmfq\"\n      ],\n      \"query_complete\": true,\n      \"observed_at_utc\": \"2026-10-01T02:47:11.834265+00:00\",\n      \"source\": \"https://api.osv.dev/v1/querybatch\"\n    },\n    {\n      \"path\": \"node_modules/workspace-helper\",\n      \"status\": \"unmapped\",\n      \"reason\": \"unsupported_identity\",\n      \"project_safe\": \"unverified\",\n      \"reachability\": \"unverified\",\n      \"auto_upgrade\": false,\n      \"auto_notify\": false\n    },\n    {\n      \"path\": \"node_modules/vendor-bin\",\n      \"status\": \"unmapped\",\n      \"reason\": \"unsupported_identity\",\n      \"project_safe\": \"unverified\",\n      \"reachability\": \"unverified\",\n      \"auto_upgrade\": false,\n      \"auto_notify\": false\n    },\n    {\n      \"path\": \"node_modules/range-example\",\n      \"status\": \"unmapped\",\n      \"reason\": \"unsupported_identity\",\n      \"project_safe\": \"unverified\",\n      \"reachability\": \"unverified\",\n      \"auto_upgrade\": false,\n      \"auto_notify\": false\n    },\n    {\n      \"path\": \"node_modules/missing-version\",\n      \"status\": \"unmapped\",\n      \"reason\": \"unsupported_identity\",\n      \"project_safe\": \"unverified\",\n      \"reachability\": \"unverified\",\n      \"auto_upgrade\": false,\n      \"auto_notify\": false\n    },\n    {\n      \"path\": \"node_modules/npm-alias\",\n      \"status\": \"unmapped\",\n      \"reason\": \"unsupported_identity\",\n      \"project_safe\": \"unverified\",\n      \"reachability\": \"unverified\",\n      \"auto_upgrade\": false,\n      \"auto_notify\": false\n    }\n  ],\n  \"unique_query_count\": 2,\n  \"source_row_count\": 8,\n  \"batch_alignment_verified\": true,\n  \"no_matches_means_safe\": false,\n  \"limits\": \"Only resolved npm registry stable exact versions from lockv3. No runtime exploitability, reachability, total-project security or freshness guarantee.\",\n  \"lockfile_sha256\": \"2e7c9d95b251017e54e66e412ac9de44880820594beaccd08bcd6766ae442b12\"\n}\n\n\n{\n  \"queries\": [\n    {\n      \"package\": {\n        \"ecosystem\": \"npm\",\n        \"name\": \"markdown-it\"\n      },\n      \"version\": \"12.3.1\"\n    },\n    {\n      \"package\": {\n        \"ecosystem\": \"npm\",\n        \"name\": \"markdown-it\"\n      },\n      \"version\": \"12.3.2\"\n    }\n  ],\n  \"response\": {\n    \"results\": [\n      {\n        \"vulns\": [\n          {\n            \"id\": \"GHSA-253c-mchw-3w2r\",\n            \"modified\": \"2026-09-29T18:15:04.692324Z\"\n          },\n          {\n            \"id\": \"GHSA-6v5v-wf23-fmfq\",\n            \"modified\": \"2026-09-10T03:51:08.074107Z\"\n          },\n          {\n            \"id\": \"GHSA-6vfc-qv3f-vr6c\",\n            \"modified\": \"2023-11-08T04:08:07.059316Z\"\n          }\n        ]\n      },\n      {\n        \"vulns\": [\n          {\n            \"id\": \"GHSA-253c-mchw-3w2r\",\n            \"modified\": \"2026-09-29T18:15:04.692324Z\"\n          },\n          {\n            \"id\": \"GHSA-6v5v-wf23-fmfq\",\n            \"modified\": \"2026-09-10T03:51:08.074107Z\"\n          }\n        ]\n      }\n    ]\n  },\n  \"observed_at_utc\": \"2026-10-01T02:47:11.834265+00:00\",\n  \"source_receipt\": \"source-receipt.json\"\n}\n", "creation_timestamp": "2026-10-01T02:50:35.000000Z"}]}