[kevin9327]

Marked version: 18.1.3 (master ba50aa9)

Markdown flavor: CommonMark|GitHub Flavored Markdown

Description

Emphasis never opens or closes inside angle brackets, even when the brackets are plain text:

Replace <*name*> with your name.

Expectation

<p>Replace &lt;<em>name</em>&gt; with your name.</p>

That is what commonmark.js and the CommonMark spec give: <*name*> is neither raw HTML nor an autolink, so it is ordinary text and the * delimiters inside count.

Result

<p>Replace &lt;*name*&gt; with your name.</p>

Same for <_one_>, <**two**>, *foo <bar* baz> and *<a*a>.

The cause is the em/strong mask: blockSkip masks every <...> run that does not start with a space (<(?! )[^<>]*?>), so emStrong never sees the delimiters in it, whether or not the run is a tag. The same shortcut cuts a real tag short at the first >: in *a <b title=">*">* the * inside the quoted attribute was left unmasked and closed the emphasis, which split the tag and rendered it as escaped text (<em>a &lt;b title=&quot;&gt;</em>&quot;&gt;*).

Fix

#maskSrc now masks blocks with a small loop (#maskBlocks). Links and code spans are masked exactly as before. For a <...> match it runs the existing inline tag and autolink rules at that position: when one matches, the whole tag or autolink is masked (also past the first >); otherwise the text stays unmasked and the scan resumes after the <. rules.ts is unchanged, so blockSkip (also used by linkInText) keeps its current regex and recheck result. The loop only adds an anchored tag/autolink attempt at positions where the inline tokenizer already tries the same rules.

Tests

• New spec test/specs/new/em_in_angle_brackets.{md,html} covering plain-text angle brackets (<*name*>, <_one_>, <**two**>, *foo <bar* baz>) and real HTML/autolinks that must stay masked (<b x="*">, <b title=">*">, <http://x.y/*z>, <!-- * -->). The expected HTML matches commonmark.js output for the same input.
• Before the fix: npm run test:specs 1983 pass / 2 fail (the new spec). After: 1985 pass / 0 fail. npm run test:unit 242 pass. eslint and tsc --noEmit clean; umd/cjs smoke tests pass.
• Rough timing on pathological inputs ('<a>*'.repeat(30000), '<*a*> '.repeat(20000), '*<x '.repeat(30000)) stays in the same range as 18.1.3 (about 45-70 ms each on my machine).

AI assistance: I used an AI coding assistant to help find this (differential fuzzing against commonmark.js), write the fix and tests; I reviewed the change and ran the test suites above.

Contributor

• Test(s) exist to ensure functionality and minimize regression (if no tests added, list tests covering this PR); or,
• no tests required for this PR.
• If submitting new feature, it has been documented in the appropriate places.

Committer

In most cases, this should be a different person than the contributor.

• CI is green (no forced merge required).
• Squash and Merge PR following conventional commit guidelines.

[vercel]

@kevin9327 is attempting to deploy a commit to the MarkedJS Team on Vercel.

A member of the Team first needs to authorize it.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
marked-website	Ready	Preview	Nov 4, 2026 3:31pm UTC