WS-2018-0031 | Mend Vulnerability Database

Vulnerability DatabaseWS-2018-0031

WS-2018-0031

Published:May 19, 2026

Updated:May 19, 2026

The affected versions (through 0.3.5) in marked package are vulnerable to Cross-Site Scripting (XSS) Due To Sanitization Bypass Using HTML Entities

Affected Packages

marked (CDN_JS):

Affected version(s) >=0.0.1 <0.3.6

Fix Suggestion:

Update to version 0.3.6

notebook (CONDA):

Affected version(s) >=4.0.1 <4.2.2

Fix Suggestion:

Update to version 4.2.2

ipython (CONDA):

Affected version(s) >=1.0.0 <4.0.0

Fix Suggestion:

Update to version 4.0.0

tensorflow (CONDA):

Affected version(s) =0.7.1 <0.8.0

Fix Suggestion:

Update to version 0.8.0

marked (NPM):

Affected version(s) >=0.0.1 <0.3.6

Fix Suggestion:

Update to version 0.3.6

polymer-core-elements (NUGET):

Affected version(s) >=0.4.2 <=0.5.5

Fix Suggestion:

Update to version no_fix

zchat (NUGET):

Affected version(s) >=1.0.0 <=1.0.1

Fix Suggestion:

Update to version no_fix

availablelight (NUGET):

Affected version(s) =1.0.7 <1.0.8

Fix Suggestion:

Update to version 1.0.8

z4a-dotnet-scaffold (NUGET):

Affected version(s) >=1.0.0.1 <1.0.0.3

Fix Suggestion:

Update to version 1.0.0.3

gnap.themes.web.gnap.angular (NUGET):

Affected version(s) >=0.22.0 <=1.1.0

Fix Suggestion:

Update to version no_fix

jsdoc (NUGET):

Affected version(s) >=3.4.0 <=4.3.0

Fix Suggestion:

Update to version no_fix

raml.parser (NUGET):

Affected version(s) >=1.0.0 <1.0.7

Fix Suggestion:

Update to version 1.0.7

polymer-iron-elements (NUGET):

Affected version(s) =1.0.0

Fix Suggestion:

Update to version no_fix

angular-markdown-editor (NUGET):

Affected version(s) >=1.0.0 <=1.1.3

Fix Suggestion:

Update to version no_fix

siezi/phile-admin-markdown-editor (PHP):

Affected version(s) >=dev-master <=2.0.0

Fix Suggestion:

Update to version no_fix

friendsofvictoire/markdown-widget (PHP):

Affected version(s) >=dev-master <=2.1.0

Fix Suggestion:

Update to version no_fix

microweber/microweber (PHP):

Affected version(s) >=dev-Radanovn-patch-1 <1.0.2.x-dev

Fix Suggestion:

Update to version 1.0.2.x-dev

ijackua/yii2-lepture-markdown-editor-widget (PHP):

Affected version(s) >=dev-master <=1.0.0

Fix Suggestion:

Update to version no_fix

ristorantino/install (PHP):

Affected version(s) =dev-ale-helpers-components <dev-master

Fix Suggestion:

Update to version dev-master

20steps/bricks-custom-acme-demo-angular-bundle (PHP):

Affected version(s) =dev-master

Fix Suggestion:

Update to version no_fix

dvlpp/sharp (PHP):

Affected version(s) >=2.0.0 <2.0.4

Fix Suggestion:

Update to version 2.0.4

websix/xlsx-compiler (PHP):

Affected version(s) =dev-master <1.0.0

Fix Suggestion:

Update to version 1.0.0

arthurgroup/websitebuilder (PHP):

Affected version(s) =dev-unsplash_integration <dev-update_custom_fields_design

Fix Suggestion:

Update to version dev-update_custom_fields_design

uikit/uikit (PHP):

Affected version(s) =2.0.0 <dev-dependabot/npm_and_yarn/dev-dependencies-32e16465c2

Fix Suggestion:

Update to version dev-dependabot/npm_and_yarn/dev-dependencies-32e16465c2

arthurgroup/websitebuilder (PHP):

Affected version(s) =1.1.7.x-dev <1.1.8.x-dev

Fix Suggestion:

Update to version 1.1.8.x-dev

visonforcoding/cakephp-wpadmin (PHP):

Affected version(s) >=dev-master <=0.1.4

Fix Suggestion:

Update to version no_fix

orchestra/story (PHP):

Affected version(s) >=v3.1.1 <3.3.x-dev

Fix Suggestion:

Update to version 3.3.x-dev

orchestra/story (PHP):

Affected version(s) =3.1.x-dev <v3.1.0

Fix Suggestion:

Update to version v3.1.0

dsheiko/extras (PHP):

Affected version(s) >=dev-master <=v1.0.3

Fix Suggestion:

Update to version no_fix

speixoto/yii2-polymer (PHP):

Affected version(s) =dev-master

Fix Suggestion:

Update to version no_fix

docit/core (PHP):

Affected version(s) =dev-master

Fix Suggestion:

Update to version no_fix

soldotno/vanilla-enterprise-module (PHP):

Affected version(s) =dev-master <1.0

Fix Suggestion:

Update to version 1.0

arthurgroup/websitebuilder (PHP):

Affected version(s) =dev-tests <dev-tg

Fix Suggestion:

Update to version dev-tg

themewizz/twz-plugin-manager-client-library (PHP):

Affected version(s) >=dev-main <5.0.3

Fix Suggestion:

Update to version 5.0.3

laraporto/laraporto (PHP):

Affected version(s) >=dev-master <=1.1.x-dev

Fix Suggestion:

Update to version no_fix

schumacherfm/markdown (PHP):

Affected version(s) >=v2.0.0 <v2.1.0-rc.1

Fix Suggestion:

Update to version v2.1.0-rc.1

piksera/core (PHP):

Affected version(s) =dev-main

Fix Suggestion:

Update to version no_fix

arthurgroup/websitebuilder (PHP):

Affected version(s) =dev-admin_mobile <dev-admin_redesign

Fix Suggestion:

Update to version dev-admin_redesign

arthurgroup/websitebuilder (PHP):

Affected version(s) =1.1.10.x-dev <1.1.11.x-dev

Fix Suggestion:

Update to version 1.1.11.x-dev

arthurgroup/websitebuilder (PHP):

Affected version(s) =dev-media_library_unsplash_update <dev-newsletter_module

Fix Suggestion:

Update to version dev-newsletter_module

adrexia/flowchart (PHP):

Affected version(s) >=dev-false-fix-new-states <=1.0.x-dev

Fix Suggestion:

Update to version no_fix

arthurgroup/websitebuilder (PHP):

Affected version(s) =dev-contact_from_email_providers <dev-custom_field_button

Fix Suggestion:

Update to version dev-custom_field_button

hoter/yii2-lepture-markdown (PHP):

Affected version(s) =dev-master

Fix Suggestion:

Update to version no_fix

lambda/yii2-neon (PHP):

Affected version(s) >=dev-master <=0.1.1

Fix Suggestion:

Update to version no_fix

microweber/microweber (PHP):

Affected version(s) >=dev-account-manager <oop-preview

Fix Suggestion:

Update to version oop-preview

dvlpp/sharp (PHP):

Affected version(s) >=1.0.0 <v1.3.28

Fix Suggestion:

Update to version v1.3.28

microweber/microweber (PHP):

Affected version(s) =1.x-dev <1.0.x-dev

Fix Suggestion:

Update to version 1.0.x-dev

microweber/microweber (PHP):

Affected version(s) >=1.0.8.x-dev <1.1.x-dev

Fix Suggestion:

Update to version 1.1.x-dev

sunra/angularjs-symfony2-bundle (PHP):

Affected version(s) >=dev-master <=v1.5.5

Fix Suggestion:

Update to version no_fix

jason-munro/cypht (PHP):

Affected version(s) >=dev-bp-get-client-issue <v1.0.0-rc1

Fix Suggestion:

Update to version v1.0.0-rc1

reliv/rcm-plugins (PHP):

Affected version(s) =dev-revert-480-master

Fix Suggestion:

Update to version no_fix

tinindja/microweber-for-laravel-5.8 (PHP):

Affected version(s) =dev-contact_form_fix_sr-1 <1.0.2.x-dev

Fix Suggestion:

Update to version 1.0.2.x-dev

tinindja/microweber-for-laravel-5.8 (PHP):

Affected version(s) >=dev-add_custom_data_on_product <oop-preview

Fix Suggestion:

Update to version oop-preview

wardrobe/cabinet (PHP):

Affected version(s) =dev-master <dev-redactor

Fix Suggestion:

Update to version dev-redactor

rami-awadallah/myhelpers (PHP):

Affected version(s) >=dev-master <=1.5.x-dev

Fix Suggestion:

Update to version no_fix

websix/xlsx-compiler (PHP):

Affected version(s) >=1.1.0 <=1.1.3

Fix Suggestion:

Update to version no_fix

rcm/plugins (PHP):

Affected version(s) =dev-revert-480-master

Fix Suggestion:

Update to version no_fix

20steps/bricks-demo-angularjs (PHP):

Affected version(s) =dev-master

Fix Suggestion:

Update to version no_fix

schumacherfm/markdown (PHP):

Affected version(s) >=v2.1.0-rc.3 <v2.2.0

Fix Suggestion:

Update to version v2.2.0

microweber/microweber (PHP):

Affected version(s) =dev-revert-797-master

Fix Suggestion:

Update to version no_fix

filsh/footable (PHP):

Affected version(s) =dev-bs3

Fix Suggestion:

Update to version no_fix

arthurgroup/websitebuilder (PHP):

Affected version(s) =1.2.x-dev <dev-1.2-test-pm

Fix Suggestion:

Update to version dev-1.2-test-pm

arthurgroup/websitebuilder (PHP):

Affected version(s) >=1.0.8.x-dev <1.0.10.x-dev

Fix Suggestion:

Update to version 1.0.10.x-dev

tinindja/microweber-for-laravel-5.8 (PHP):

Affected version(s) >=1.0.8.x-dev <1.1.x-dev

Fix Suggestion:

Update to version 1.1.x-dev

greenpower/asset-bundle (PHP):

Affected version(s) =dev-develop

Fix Suggestion:

Update to version no_fix

dungphanxuan/yii2-lepture-editor (PHP):

Affected version(s) >=dev-master <=0.1

Fix Suggestion:

Update to version no_fix

arthurgroup/websitebuilder (PHP):

Affected version(s) =dev-dependabot/composer/composer/composer-1.10.23 <dev-fix_backup_encoding_v2

Fix Suggestion:

Update to version dev-fix_backup_encoding_v2

salimkamboh/yii2-angularjs (PHP):

Affected version(s) >=dev-main <=1.0

Fix Suggestion:

Update to version no_fix

etdsolutions/marked (PHP):

Affected version(s) >=dev-master <=0.3.5

Fix Suggestion:

Update to version no_fix

notebook (PYTHON):

Affected version(s) >=4.0.1 <4.2.2

Fix Suggestion:

Update to version 4.2.2

ipython (PYTHON):

Affected version(s) >=1.0.0 <4.0.0

Fix Suggestion:

Update to version 4.0.0

Related Resources (3)

https://github.com/RetireJS/retire.js/commit/586b6c4371702ed853609a4451ad2b2c7984a788

https://github.com/markedjs/marked/commit/2cff85979be8e7a026a9aca35542c470cf5da523

https://github.com/markedjs/marked/pull/592

Do you need more information?

CVSS v4

Base Score:

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Attack Requirements

NONE

Privileges Required

NONE

User Interaction

PASSIVE

Vulnerable System Confidentiality

LOW

Vulnerable System Integrity

LOW

Vulnerable System Availability

LOW

Subsequent System Confidentiality

LOW

Subsequent System Integrity

LOW

Subsequent System Availability

LOW

CVSS v3

Base Score:

7.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality

LOW

Integrity

LOW

Availability

LOW