marked

A markdown parser built for speed

Latest 18.1.1

94%

Total Score

healthy

Long-term releases, active contributors, and verified publishing outweigh minor workflow pinning and license-coverage concerns.

Are you affected? Scan for Free

Health Score Breakdown

License

The artifact declares MIT and includes a license file, but the detected file text also names BSD-3-Clause, which is not covered by the manifest declaration. This is a minor licensing-transparency concern, not an absence of licensing.

Workflow audit

The only workflow was fully analyzed, uses read-only permissions, has no untrusted checkout or script-injection findings, and has no audit findings. However, all six referenced actions are unpinned, leaving a minor reproducibility and supply-chain hygiene gap.

Vulnerabilities

Title	Versions	Severity
CVE-2026-41680 marked is vulnerable to Uncontrolled Resource Consumption in versions 18.0.0 - 18.0.1.	18.0.0 - 18.0.1	High
AIKIDO-2026-10452 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. marked is vulnerable to Regular Expression Denial of Service (ReDoS) in versions 16.4.0 - 17.0.4.	16.4.0 - 17.0.4	Medium
CVE-2018-25110 marked is vulnerable to Inefficient Regular Expression Complexity in versions 0.0.0 - 0.3.17.	0.0.0 - 0.3.17	Medium
CVE-2022-21680 marked is vulnerable to Uncontrolled Resource Consumption in versions 0.0.0 - 4.0.10.	0.0.0 - 4.0.10	High
CVE-2022-21681 marked is vulnerable to Inefficient Regular Expression Complexity in versions 0.0.0 - 4.0.10.	0.0.0 - 4.0.10	High