marker npm Package Path Traversal Vulnerability: CVE-2026-85684
- Severity
- CRITICAL
- CVSS
- 9.1
- Affected component
- marker (npm)
- Affected versions
- >= v2.0.0, <= v2.0.0 or >= v1.10.2, <= v1.10.2 or >= v1.10.1, <= v1.10.1 or >= v1.10.0, <= v1.10.0 or >= v1.9.3, <= v1.9.3 or >= v1.9.2, <= v1.9.2 or >= v1.9.1, <= v1.9.1 or >= v1.9.0, <= v1.9.0 or >= v1.8.5, <= v1.8.5 or >= v1.8.4, <= v1.8.4 or >= v1.8.3, <= v1.8.3 or >= v1.8.2, <= v1.8.2 or >= v1.8.1, <= v1.8.1 or >= v1.8.0, <= v1.8.0 or >= v1.7.5, <= v1.7.5 or >= v1.7.4, <= v1.7.4 or >= v1.7.3, <= v1.7.3 or >= v1.7.2, <= v1.7.2 or >= v1.7.1, <= v1.7.1 or >= v1.7.0, <= v1.7.0 or >= v1.6.2, <= v1.6.2 or >= v1.6.1, <= v1.6.1 or >= v1.6.0, <= v1.6.0 or >= v1.5.5, <= v1.5.5 or >= v1.5.4, <= v1.5.4 or >= v1.5.3, <= v1.5.3 or >= v1.5.2, <= v1.5.2 or >= v1.5.1, <= v1.5.1 or >= v1.5.0, <= v1.5.0 or >= v1.4.0, <= v1.4.0 or >= v1.3.5, <= v1.3.5 or >= v1.3.4, <= v1.3.4 or >= v1.3.3, <= v1.3.3 or >= v1.3.2, <= v1.3.2 or >= v1.3.1, <= v1.3.1 or >= v1.3.0, <= v1.3.0 or >= v1.2.7, <= v1.2.7 or >= v1.2.6, <= v1.2.6 or >= v1.2.5, <= v1.2.5 or >= v1.2.4, <= v1.2.4 or >= v1.2.3, <= v1.2.3 or >= v1.2.2, <= v1.2.2 or >= v1.2.1, <= v1.2.1 or >= v1.2.0, <= v1.2.0 or >= v1.1.0, <= v1.1.0 or >= v1.0.2, <= v1.0.2 or >= v1.0.1, <= v1.0.1 or >= v1.0.0, <= v1.0.0 or >= v0.3.10, <= v0.3.10 or >= v0.3.9, <= v0.3.9 or >= v0.3.8, <= v0.3.8 or >= v0.3.7, <= v0.3.7 or >= v0.3.6, <= v0.3.6 or >= v0.3.5, <= v0.3.5 or >= v0.3.4, <= v0.3.4 or >= v0.3.3, <= v0.3.3 or >= v0.3.2, <= v0.3.2 or >= v0.3.1, <= v0.3.1 or >= v0.3.0, <= v0.3.0 or >= v0.2.17, <= v0.2.17 or >= v0.2.16, <= v0.2.16 or >= v0.2.15, <= v0.2.15 or >= v0.2.14, <= v0.2.14 or >= v0.2.13, <= v0.2.13 or >= v0.2.12, <= v0.2.12 or >= v0.2.11, <= v0.2.11 or >= v0.2.10, <= v0.2.10 or >= v0.2.9, <= v0.2.9 or >= v0.2.8, <= v0.2.8 or >= v0.2.7, <= v0.2.7 or >= v0.2.6, <= v0.2.6 or >= v0.2.5, <= v0.2.5
- Patched version
- Not yet available
The marker npm package through version 2.0.0 contains a critical path traversal vulnerability. This affects users of the marker package in versions up to 2.0.0.
What happened
The marker npm package versions up to 2.0.0 have a path traversal vulnerability in the FastAPI /marker/upload handler. This vulnerability arises because the file.filename parameter is not properly sanitized. An unauthenticated attacker can exploit this by supplying filenames with directory traversal sequences to write arbitrary files to any location or delete existing files on the system.
This vulnerability was first flagged on September 4, 2026, and confirmed on September 8, 2026. The CVSS score is 9.1, indicating a critical severity level. The vulnerability has not been exploited in the wild as of the latest information.
What to do about it
- Upgrade to a version of marker that fixes the path traversal vulnerability.
- Ensure that file.filename is properly sanitized in your application.
- Review your application for any instances where untrusted input is used to construct file paths.
- Consider implementing additional security measures such as file upload size limits and file type validation.
How 0Day would have caught this
marker is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are affected if you are using the marker npm package in versions up to 2.0.0.
What should I do right now?
Upgrade to a version of marker that fixes the path traversal vulnerability and ensure that file.filename is properly sanitized.
Is there a patched version available?
The primary sources should be consulted for the latest information on patched versions.