healthcare medical

technology software

entertainment media

cryptocurrency blockchain

adult content

English

The domain name 'stuff.mutant.workers.dev' uses the developer-focused generic top-level domain (.dev), featuring subdomain 'stuff.mutant'. The registrable portion 'workers' spans 7 characters with two vowels and five consonants. Splitting it apart reveals one word: workers. Expect seven characters per word on average. No strong language cues emerged from the frequency lists.

html/86/2e/862e73f8-ac03-4fa4-9772-405c4bd67c56.html.gz

application/x-www-form-urlencoded; charset=UTF-8

require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes

ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

ab35215692aa8aa6154484264d6572bc360df68af7bfb9d69b19ec984ad20910

965f463194b70ca4ee45d370d96511ac1f1c0619453c24470d1829aabe1e9690

0376df34ddd565ffb33a4b96097297fdd687ddb14ba17716fc2aaf6fed6e1928

51e4283d594215cec5af0524d781675b17035c5c4f5cbe5bda4070112450df03

325d19f9a1f62ad82f9f382a877f42bf447c8cbb293dd7cd2c03cf3bcf2f146a

### Impact

_What kind of vulnerability is it?_

Denial of service.

The regular expression `inline.reflinkSearch` may cause catastrophic backtracking against some strings.
PoC is the following.

```javascript
import * as marked from 'marked';

console.log(marked.parse(`[x]: x

\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](`));
```

_Who is impacted?_

Anyone who runs untrusted markdown through marked and does not use a worker with a time limit.

### Patches

_Has the problem been patched?_

Yes

_What versions should users upgrade to?_

4.0.10

### Workarounds

_Is there a way for users to fix or remediate the vulnerability without upgrading?_

Do not run untrusted markdown through marked or run marked on a [worker](https://marked.js.org/using_advanced#workers) thread and set a reasonable time limit to prevent draining resources.

### References

_Are there any links users can visit to find out more?_

- https://marked.js.org/using_advanced#workers
- https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS

### For more information

If you have any questions or comments about this advisory:

* Open an issue in [marked](https://github.com/markedjs/marked)


### Impact

_What kind of vulnerability is it?_

Denial of service.

The regular expression `block.def` may cause catastrophic backtracking against some strings.
PoC is the following.

```javascript
import * as marked from "marked";

marked.parse(`[x]:${' '.repeat(1500)}x ${' '.repeat(1500)} x`);
```

_Who is impacted?_

Anyone who runs untrusted markdown through marked and does not use a worker with a time limit.

### Patches

_Has the problem been patched?_

Yes

_What versions should users upgrade to?_

4.0.10

### Workarounds

_Is there a way for users to fix or remediate the vulnerability without upgrading?_

Do not run untrusted markdown through marked or run marked on a [worker](https://marked.js.org/using_advanced#workers) thread and set a reasonable time limit to prevent draining resources.

### References

_Are there any links users can visit to find out more?_

- https://marked.js.org/using_advanced#workers
- https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS

### For more information

If you have any questions or comments about this advisory:

* Open an issue in [marked](https://github.com/markedjs/marked)


PDF.js vulnerable to arbitrary JavaScript execution upon opening a malicious PDF

7359ca495baeba70d083bfc203de8402803550646abae3b746388acbfb37dde0

width=device-width, initial-scale=1.0,maximum-scale=1.0, user-scalable=no

viewport

robots

Abuse Team

CloudFlare, Inc.

workers.dev

Google Inc.

Google LLC

GOOGLE


    window.drive_names = JSON.parse('["FamilyTherapy","FamilyTherapy Two","FamilyTherapy SiteRip 720p","BrattySis Vol 9 2021","BrattySis SiteRip","SisLovesMe FHD","SisLovesMe.com","SisLovesMe","SisLovesMe SiteRip Jan2019","Lie With Me","Q 2011"]');
    window.MODEL = JSON.parse('{"root_type":2}');
    window.current_drive_order = 0;
    window.UI = JSON.parse('{"theme":"cyborg","version":"2.0.26","logo_image":true,"logo_height":"50px","logo_width":"50px","favicon":"https://cdn.jsdelivr.net/npm/@googledrive/index@2.0.26/images/favicon.ico","logo_link_name":"https://cdn.svgporn.com/logos/atomic-icon.svg","fixed_header":true,"header_padding":"60","nav_link_1":"Home","nav_link_3":"Current Path","nav_link_4":"Contact","fixed_footer":false,"hide_footer":true,"header_style_class":"navbar-dark bg-dark","footer_style_class":"bg-primary","css_a_tag_color":"white","css_p_tag_color":"white","folder_text_color":"white","loading_spinner_class":"text-danger","search_button_class":"btn btn-outline-danger","path_nav_alert_class":"alert alert-light","file_view_alert_class":"alert alert-danger","file_count_alert_class":"alert alert-light","contact_link":"https://google.com","copyright_year":"2021","company_name":"Mut@nt Cloud","company_link":"https://google.com","credit":false,"display_size":true,"display_time":false,"display_download":true,"disable_player":false,"custom_srt_lang":"","disable_video_download":false,"second_domain_for_dl":false,"downloaddomain":"","poster":"https://cdn.jsdelivr.net/npm/@googledrive/index@2.0.26/images/poster.jpg","audioposter":"https://cdn.jsdelivr.net/npm/@googledrive/index@2.0.26/images/music.jpg","jsdelivr_cdn_src":"https://cdn.jsdelivr.net/npm/@googledrive/index","render_head_md":true,"render_readme_md":true,"display_drive_link":false,"plyr_io_version":"3.6.4","plyr_io_video_resolution":"16:9","unauthorized_owner_link":"https://google.com","unauthorized_owner_email":"spam@sample.com","arc_code":"jfoY2h19","search_all_drives":false}');
  

Requests	IP Address	Location	AS Autonomous System
5	188.114.97.3Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
4	198.202.211.1	United States	AS209242Cloudflare London, LLC
4	104.17.208.5Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
4	104.26.12.19Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
17	4	-	-

Security Scan Report: stuff.mutant.workers.dev

Summary

AI Security Verdict

Low Risk

Safety Factors

Details

Screenshot

Page Load Overview

Language Analysis

Primary Language

Detection Details

Website Classification

Primary Category

All Detected Categories

Detected Features

Domain & IP Information

Page Statistics

Detected Technologies6

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

ssdeep (Context Triggered Piecewise Hashing)

sdhash (Similarity Digest Hashing)

Image Hashes

Perceptual Hashes

Other Hashes

Scan History