{"id":"UBUNTU-CVE-2015-1370","details":"Incomplete blacklist vulnerability in marked 0.3.2 and earlier for Node.js allows remote attackers to conduct cross-site scripting (XSS) attacks via a vbscript tag in a link.","modified":"2025-10-24T04:45:19Z","published":"2015-01-27T20:04:00Z","upstream":["CVE-2015-1370"],"references":[{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2015-1370"},{"type":"REPORT","url":"https://nodesecurity.io/advisories/marked_vbscript_injection"},{"type":"REPORT","url":"https://github.com/chjj/marked/issues/492"},{"type":"REPORT","url":"https://github.com/evilpacket/marked/commit/3c191144939107c45a7fa11ab6cb88be6694a1ba"},{"type":"REPORT","url":"http://www.openwall.com/lists/oss-security/2015/01/23/2"},{"type":"REPORT","url":"https://www.cve.org/CVERecord?id=CVE-2015-1370"}],"affected":[{"package":{"name":"node-marked","ecosystem":"Ubuntu:16.04:LTS","purl":"pkg:deb/ubuntu/node-marked@0.3.2+dfsg-1?arch=source&distro=xenial"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.3.2+dfsg-1"],"ecosystem_specific":{"binaries":[{"binary_name":"libjs-marked","binary_version":"0.3.2+dfsg-1"},{"binary_name":"node-marked","binary_version":"0.3.2+dfsg-1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2015/UBUNTU-CVE-2015-1370.json"}}],"schema_version":"1.7.3","severity":[{"type":"Ubuntu","score":"medium"}]}