WS-2018-0031 | Mend Vulnerability Database

Vulnerability DatabaseWS-2018-0031

WS-2018-0031

Published:May 13, 2026

Updated:May 13, 2026

The affected versions (through 0.3.5) in marked package are vulnerable to Cross-Site Scripting (XSS) Due To Sanitization Bypass Using HTML Entities

Affected Packages

marked (CDN_JS):

Affected version(s) >=0.0.1 <0.3.6

Fix Suggestion:

Update to version 0.3.6

ipython (CONDA):

Affected version(s) >=1.0.0 <4.0.0

Fix Suggestion:

Update to version 4.0.0

notebook (CONDA):

Affected version(s) >=4.0.1 <4.2.2

Fix Suggestion:

Update to version 4.2.2

tensorflow (CONDA):

Affected version(s) =0.7.1 <0.8.0

Fix Suggestion:

Update to version 0.8.0

marked (NPM):

Affected version(s) >=0.0.1 <0.3.6

Fix Suggestion:

Update to version 0.3.6

jsdoc (NUGET):

Affected version(s) >=3.4.0 <=4.3.0

Fix Suggestion:

Update to version no_fix

gnap.themes.web.gnap.angular (NUGET):

Affected version(s) >=0.22.0 <=1.1.0

Fix Suggestion:

Update to version no_fix

polymer-iron-elements (NUGET):

Affected version(s) =1.0.0

Fix Suggestion:

Update to version no_fix

z4a-dotnet-scaffold (NUGET):

Affected version(s) >=1.0.0.1 <1.0.0.3

Fix Suggestion:

Update to version 1.0.0.3

raml.parser (NUGET):

Affected version(s) >=1.0.0 <1.0.7

Fix Suggestion:

Update to version 1.0.7

availablelight (NUGET):

Affected version(s) =1.0.7 <1.0.8

Fix Suggestion:

Update to version 1.0.8

angular-markdown-editor (NUGET):

Affected version(s) >=1.0.0 <=1.1.3

Fix Suggestion:

Update to version no_fix

polymer-core-elements (NUGET):

Affected version(s) >=0.4.2 <=0.5.5

Fix Suggestion:

Update to version no_fix

zchat (NUGET):

Affected version(s) >=1.0.0 <=1.0.1

Fix Suggestion:

Update to version no_fix

dvlpp/sharp (PHP):

Affected version(s) >=1.0.0 <v1.3.28

Fix Suggestion:

Update to version v1.3.28

microweber/microweber (PHP):

Affected version(s) =dev-revert-797-master

Fix Suggestion:

Update to version no_fix

microweber/microweber (PHP):

Affected version(s) >=dev-account-manager <oop-preview

Fix Suggestion:

Update to version oop-preview

orchestra/story (PHP):

Affected version(s) =3.1.x-dev <v3.1.0

Fix Suggestion:

Update to version v3.1.0

rami-awadallah/myhelpers (PHP):

Affected version(s) >=dev-master <=1.5.x-dev

Fix Suggestion:

Update to version no_fix

wardrobe/cabinet (PHP):

Affected version(s) =dev-master <dev-redactor

Fix Suggestion:

Update to version dev-redactor

themewizz/twz-plugin-manager-client-library (PHP):

Affected version(s) >=dev-main <5.0.3

Fix Suggestion:

Update to version 5.0.3

rcm/plugins (PHP):

Affected version(s) =dev-revert-480-master

Fix Suggestion:

Update to version no_fix

lambda/yii2-neon (PHP):

Affected version(s) >=dev-master <=0.1.1

Fix Suggestion:

Update to version no_fix

siezi/phile-admin-markdown-editor (PHP):

Affected version(s) >=dev-master <=2.0.0

Fix Suggestion:

Update to version no_fix

websix/xlsx-compiler (PHP):

Affected version(s) >=1.1.0 <=1.1.3

Fix Suggestion:

Update to version no_fix

microweber/microweber (PHP):

Affected version(s) >=1.0.8.x-dev <1.1.x-dev

Fix Suggestion:

Update to version 1.1.x-dev

salimkamboh/yii2-angularjs (PHP):

Affected version(s) >=dev-main <=1.0

Fix Suggestion:

Update to version no_fix

tinindja/microweber-for-laravel-5.8 (PHP):

Affected version(s) >=1.0.8.x-dev <1.1.x-dev

Fix Suggestion:

Update to version 1.1.x-dev

speixoto/yii2-polymer (PHP):

Affected version(s) =dev-master

Fix Suggestion:

Update to version no_fix

laraporto/laraporto (PHP):

Affected version(s) >=dev-master <=1.1.x-dev

Fix Suggestion:

Update to version no_fix

ristorantino/install (PHP):

Affected version(s) =dev-ale-helpers-components <dev-master

Fix Suggestion:

Update to version dev-master

websix/xlsx-compiler (PHP):

Affected version(s) =dev-master <1.0.0

Fix Suggestion:

Update to version 1.0.0

adrexia/flowchart (PHP):

Affected version(s) >=dev-false-fix-new-states <=1.0.x-dev

Fix Suggestion:

Update to version no_fix

docit/core (PHP):

Affected version(s) =dev-master

Fix Suggestion:

Update to version no_fix

friendsofvictoire/markdown-widget (PHP):

Affected version(s) >=dev-master <=2.1.0

Fix Suggestion:

Update to version no_fix

arthurgroup/websitebuilder (PHP):

Affected version(s) =dev-media_library_unsplash_update <dev-newsletter_module

Fix Suggestion:

Update to version dev-newsletter_module

20steps/bricks-custom-acme-demo-angular-bundle (PHP):

Affected version(s) =dev-master

Fix Suggestion:

Update to version no_fix

dungphanxuan/yii2-lepture-editor (PHP):

Affected version(s) >=dev-master <=0.1

Fix Suggestion:

Update to version no_fix

piksera/core (PHP):

Affected version(s) =dev-main

Fix Suggestion:

Update to version no_fix

schumacherfm/markdown (PHP):

Affected version(s) >=v2.1.0-rc.3 <v2.2.0

Fix Suggestion:

Update to version v2.2.0

arthurgroup/websitebuilder (PHP):

Affected version(s) =dev-contact_from_email_providers <dev-custom_field_button

Fix Suggestion:

Update to version dev-custom_field_button

arthurgroup/websitebuilder (PHP):

Affected version(s) =dev-unsplash_integration <dev-update_custom_fields_design

Fix Suggestion:

Update to version dev-update_custom_fields_design

microweber/microweber (PHP):

Affected version(s) >=dev-Radanovn-patch-1 <1.0.2.x-dev

Fix Suggestion:

Update to version 1.0.2.x-dev

visonforcoding/cakephp-wpadmin (PHP):

Affected version(s) >=dev-master <=0.1.4

Fix Suggestion:

Update to version no_fix

arthurgroup/websitebuilder (PHP):

Affected version(s) =1.1.10.x-dev <1.1.11.x-dev

Fix Suggestion:

Update to version 1.1.11.x-dev

arthurgroup/websitebuilder (PHP):

Affected version(s) >=1.0.8.x-dev <1.0.10.x-dev

Fix Suggestion:

Update to version 1.0.10.x-dev

jason-munro/cypht (PHP):

Affected version(s) >=dev-bp-get-client-issue <v1.0.0-rc1

Fix Suggestion:

Update to version v1.0.0-rc1

microweber/microweber (PHP):

Affected version(s) =1.x-dev <1.0.x-dev

Fix Suggestion:

Update to version 1.0.x-dev

20steps/bricks-demo-angularjs (PHP):

Affected version(s) =dev-master

Fix Suggestion:

Update to version no_fix

ijackua/yii2-lepture-markdown-editor-widget (PHP):

Affected version(s) >=dev-master <=1.0.0

Fix Suggestion:

Update to version no_fix

arthurgroup/websitebuilder (PHP):

Affected version(s) =1.2.x-dev <dev-1.2-test-pm

Fix Suggestion:

Update to version dev-1.2-test-pm

dsheiko/extras (PHP):

Affected version(s) >=dev-master <=v1.0.3

Fix Suggestion:

Update to version no_fix

greenpower/asset-bundle (PHP):

Affected version(s) =dev-develop

Fix Suggestion:

Update to version no_fix

tinindja/microweber-for-laravel-5.8 (PHP):

Affected version(s) =dev-contact_form_fix_sr-1 <1.0.2.x-dev

Fix Suggestion:

Update to version 1.0.2.x-dev

schumacherfm/markdown (PHP):

Affected version(s) >=v2.0.0 <v2.1.0-rc.1

Fix Suggestion:

Update to version v2.1.0-rc.1

reliv/rcm-plugins (PHP):

Affected version(s) =dev-revert-480-master

Fix Suggestion:

Update to version no_fix

etdsolutions/marked (PHP):

Affected version(s) >=dev-master <=0.3.5

Fix Suggestion:

Update to version no_fix

arthurgroup/websitebuilder (PHP):

Affected version(s) =1.1.7.x-dev <1.1.8.x-dev

Fix Suggestion:

Update to version 1.1.8.x-dev

sunra/angularjs-symfony2-bundle (PHP):

Affected version(s) >=dev-master <=v1.5.5

Fix Suggestion:

Update to version no_fix

arthurgroup/websitebuilder (PHP):

Affected version(s) =dev-dependabot/composer/composer/composer-1.10.23 <dev-fix_backup_encoding_v2

Fix Suggestion:

Update to version dev-fix_backup_encoding_v2

orchestra/story (PHP):

Affected version(s) >=v3.1.1 <3.3.x-dev

Fix Suggestion:

Update to version 3.3.x-dev

arthurgroup/websitebuilder (PHP):

Affected version(s) =dev-admin_mobile <dev-admin_redesign

Fix Suggestion:

Update to version dev-admin_redesign

dvlpp/sharp (PHP):

Affected version(s) >=2.0.0 <2.0.4

Fix Suggestion:

Update to version 2.0.4

filsh/footable (PHP):

Affected version(s) =dev-bs3

Fix Suggestion:

Update to version no_fix

hoter/yii2-lepture-markdown (PHP):

Affected version(s) =dev-master

Fix Suggestion:

Update to version no_fix

tinindja/microweber-for-laravel-5.8 (PHP):

Affected version(s) >=dev-add_custom_data_on_product <oop-preview

Fix Suggestion:

Update to version oop-preview

uikit/uikit (PHP):

Affected version(s) =2.0.0 <dev-dependabot/npm_and_yarn/dev-dependencies-32e16465c2

Fix Suggestion:

Update to version dev-dependabot/npm_and_yarn/dev-dependencies-32e16465c2

soldotno/vanilla-enterprise-module (PHP):

Affected version(s) =dev-master <1.0

Fix Suggestion:

Update to version 1.0

arthurgroup/websitebuilder (PHP):

Affected version(s) =dev-tests <dev-tg

Fix Suggestion:

Update to version dev-tg

notebook (PYTHON):

Affected version(s) >=4.0.1 <4.2.2

Fix Suggestion:

Update to version 4.2.2

ipython (PYTHON):

Affected version(s) >=1.0.0 <4.0.0

Fix Suggestion:

Update to version 4.0.0

Related Resources (3)

https://github.com/markedjs/marked/pull/592

https://github.com/RetireJS/retire.js/commit/586b6c4371702ed853609a4451ad2b2c7984a788

https://github.com/markedjs/marked/commit/2cff85979be8e7a026a9aca35542c470cf5da523

Do you need more information?

CVSS v4

Base Score:

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Attack Requirements

NONE

Privileges Required

NONE

User Interaction

PASSIVE

Vulnerable System Confidentiality

LOW

Vulnerable System Integrity

LOW

Vulnerable System Availability

LOW

Subsequent System Confidentiality

LOW

Subsequent System Integrity

LOW

Subsequent System Availability

LOW

CVSS v3

Base Score:

7.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality

LOW

Integrity

LOW

Availability

LOW