4.9
CVE-2026-27807
- EPSS 0.28%
- Veröffentlicht 06.03.2026 02:48:28
- Zuletzt bearbeitet 12.03.2026 17:22:20
- Quelle security-advisories@github.com
- CVE-Watchlists
- Unerledigt
MarkUs: YAML alias (‘billion laughs’) DoS in config upload
MarkUs is a web application for the submission and grading of student assignments. Prior to version 2.9.4, MarkUs allows course instructors to upload YAML files to create/update various entities (e.g., assignment settings). These YAML files are parsed with aliases enabled. This issue has been patched in version 2.9.4.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Markusproject ≫ Markus Version < 2.9.4
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. 
Login
Login| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.28% | 0.199 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| security-advisories@github.com | 4.9 | 1.2 | 3.6 |
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
|
CWE-776 Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')
The product uses XML documents and allows their structure to be defined with a Document Type Definition (DTD), but it does not properly control the number of recursive definitions of entities.
https://github.com/MarkUsProject/Markus/releases/tag/v2.9.4
https://github.com/MarkUsProject/Markus/security/advisories/GHSA-m9rx-85mx-q9h6