Installations

npm install marked

Pull Requests

Open

2

Total

1,881

Closed

428

Merged

1,451

Issues

Open

18

Total

1,533

Closed

1,515

Releases

141

v15.0.2

Published on 20 Nov 2024

v15.0.1

Published on 18 Nov 2024

v15.0.0

Published on 09 Nov 2024

v14.1.4

Published on 07 Nov 2024

v14.1.3

Published on 15 Oct 2024

v14.1.2

Published on 08 Sept 2024

View all 141 releases

Developer

markedjs

Developer Guide

BETA

Module System

ESM, UMD

Min. Node Version

>= 18

Typescript Support

Yes

Node Version

22.11.0

NPM Version

10.8.2 Statistics

33,279 Stars

3,495 Commits

3,393 Forks

387 Watching

2 Branches

185 Contributors

Updated on 27 Nov 2024

Languages

JavaScript (35.35%)

TypeScript (34.88%)

HTML (29.78%)

Total Downloads

Cumulative downloads

Total Downloads

1,751,770,619

Last day

-0%

2,348,599

Compared to previous day

Last week

5%

12,926,752

Compared to previous week

Last month

26.5%

50,084,334

Compared to previous month

Last year

23.1%

474,992,966

Compared to previous year

Daily Downloads

Weekly Downloads

Monthly Downloads

Yearly Downloads

Dev Dependencies

25

Versions

Marked

⚡ built for speed
⬇️ low-level compiler for parsing markdown without caching or blocking for long periods of time
⚖️ light-weight while implementing all markdown features from the supported flavors & specifications
🌐 works in a browser, on a server, or from a command line interface (CLI)

Demo

Checkout the demo page to see marked in action ⛹️

Docs

Our documentation pages are also rendered using marked 💯

Compatibility

Node.js: Only current and LTS Node.js versions are supported. End of life Node.js versions may become incompatible with Marked at any point in time.

Browser: Not IE11 :)

Installation

CLI:

1npm install -g marked

In-browser:

1npm install marked

Usage

Warning: 🚨 Marked does not sanitize the output HTML. Please use a sanitize library, like DOMPurify (recommended), sanitize-html or insane on the output HTML! 🚨

DOMPurify.sanitize(marked.parse(`<img src="x" onerror="alert('not happening')">`));

CLI

1# Example with stdin input
2$ marked -o hello.html
3hello world
4^D
5$ cat hello.html
6<p>hello world</p>

1# Print all options
2$ marked --help

Browser

1<!doctype html>
2<html>
3<head>
4  <meta charset="utf-8"/>
5  <title>Marked in the browser</title>
6</head>
7<body>
8  <div id="content"></div>
9  <script src="https://cdn.jsdelivr.net/npm/marked/marked.min.js"></script>
10  <script>
11    document.getElementById('content').innerHTML =
12      marked.parse('# Marked in the browser\n\nRendered by **marked**.');
13  </script>
14</body>
15</html>

or import esm module

1<script type="module">
2  import { marked } from "https://cdn.jsdelivr.net/npm/marked/lib/marked.esm.js";
3  document.getElementById('content').innerHTML =
4    marked.parse('# Marked in the browser\n\nRendered by **marked**.');
5</script>

License

Stable Version

The latest stable version of the package.

Stable Version

15.0.2

HIGH

4

HIGH

7.5/10

Summary

Regular Expression Denial of Service in marked

Affected Versions

< 0.3.4

Patched Versions

0.3.4

HIGH

7.5/10

Summary

Inefficient Regular Expression Complexity in marked

Affected Versions

< 4.0.10

Patched Versions

4.0.10

HIGH

7.5/10

Summary

Inefficient Regular Expression Complexity in marked

Affected Versions

< 4.0.10

Patched Versions

4.0.10

HIGH

7.5/10

Summary

Regular Expression Denial of Service in marked

Affected Versions

< 0.3.9

Patched Versions

0.3.9

MODERATE

11

MODERATE

6.1/10

Summary

Marked vulnerable to XSS from data URIs

Affected Versions

< 0.3.7

Patched Versions

0.3.7

MODERATE

6.1/10

Summary

Sanitization bypass using HTML Entities in marked

Affected Versions

< 0.3.6

Patched Versions

0.3.6

MODERATE

0/10

Summary

Content injection in marked

Affected Versions

< 0.3.9

Patched Versions

0.3.9

MODERATE

0/10

Summary

Regular Expression Denial of Service

Affected Versions

>= 0.5.0, < 0.6.1

Patched Versions

0.6.1

MODERATE

0/10

Summary

Cross-Site Scripting in marked

Affected Versions

< 0.3.9

Patched Versions

0.3.9

MODERATE

0/10

Summary

Moderate severity vulnerability that affects marked

Affected Versions

< 0.3.3

Patched Versions

0.3.3

MODERATE

5.3/10

Summary

Marked ReDoS due to email addresses being evaluated in quadratic time

Affected Versions

>= 0.3.14, < 0.6.2

Patched Versions

0.6.2

MODERATE

5.3/10

Summary

Regular Expression Denial of Service (REDoS) in Marked

Affected Versions

>= 1.1.1, < 2.0.0

Patched Versions

2.0.0

MODERATE

6.1/10

Summary

Multiple Content Injection Vulnerabilities in marked

Affected Versions

<= 0.3.0

Patched Versions

0.3.1

MODERATE

0/10

Summary

Moderate severity vulnerability that affects marked

Affected Versions

< 0.3.9

Patched Versions

0.3.9

MODERATE

0/10

Summary

VBScript Content Injection in marked

Affected Versions

< 0.3.3

Patched Versions

0.3.3

LOW

1

LOW

0/10

Summary

Regular Expression Denial of Service in marked

Affected Versions

>= 0.4.0, < 0.7.0

Patched Versions

0.7.0

10

Security-Policy

Determines if the project has published a security policy.

10

Maintained

Determines if the project is "actively maintained".

10

Token-Permissions

Determines if the project's workflows follow the principle of least privilege.

10

Dangerous-Workflow

Determines if the project's GitHub Action workflows avoid dangerous patterns.

10

Binary-Artifacts

Determines if the project has generated executable (binary) artifacts in the source repository.

10

Packaging

Determines if the project is published as a package that others can easily download, install, easily update, and uninstall.

9

License

Determines if the project has defined a license.

8

Vulnerabilities

Determines if the project has open, known unfixed vulnerabilities.

6

Code-Review

Determines if the project requires human code review before pull requests (aka merge requests) are merged.

3

Pinned-Dependencies

Determines if the project has declared and pinned the dependencies of its build process.

0

CII-Best-Practices

Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.

0

Fuzzing

Determines if the project uses fuzzing.

0

SAST

Determines if the project uses static code analysis.

Score

7.3

/10

Last Scanned on 2024-11-18

The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.

Learn More

Other packages similar to marked

Other packages similar to marked

marked

Installations

Pull Requests

2

1,881

428

1,451

Issues

18

1,533

1,515

Releases

Developer

Developer Guide

ESM, UMD

>= 18

Yes

22.11.0

10.8.2

Statistics

Languages

Total Downloads

1,751,770,619

Daily Downloads

Weekly Downloads

Monthly Downloads

Yearly Downloads

Dev Dependencies

Marked

Demo

Docs

Compatibility

Installation

Usage

Warning: 🚨 Marked does not sanitize the output HTML. Please use a sanitize library, like DOMPurify (recommended), sanitize-html or insane on the output HTML! 🚨

License

Stable Version

15.0.2

HIGH

MODERATE

LOW

10

10

10

10

10

10

9

8

6

3

0

0

0

7.3

/10