@0xwork/connect (>=0.1.0, <=0.1.9), @7n/rules (>=1.0.0, <=1.118.11) +544 more potentially affected by unknown CVE via markdown-it (>=14.0.0, <=14.3.0)

markdown-it NPM version =14.0.0, =0.1.0, =1.0.0, =2026.6.2, =4.10.0, =2026.4.23-zh, =1.0.0, =5.52.1-fa.2, =5.52.1-fa.2, =2.3.0, =2.24.0 - @amap-lbs/amap-a2ui 0.1.0 - @apilium/mayros-matrix 0.1.1 and more Source cves: unknown CVE Source advisory: OSV:GHSA-253C-MCHW-3W2R...

GHSA-253C-MCHW-3W2R markdown-it linkify: true has two quadratic paths, so a few hundred KB of markdown blocks the event loop for tens of seconds

Summary Two independent quadratic paths in the linkify: true handling. Both are in markdown-it's own code rather than in linkify-it, which stays linear on both payloads. src/rulescore/linkify.ts calls arrayReplaceAt once per linkified text token, and that rebuilds the whole children array each...

markdown-it linkify: true has two quadratic paths, so a few hundred KB of markdown blocks the event loop for tens of seconds

Summary Two independent quadratic paths in the linkify: true handling. Both are in markdown-it's own code rather than in linkify-it, which stays linear on both payloads. src/rulescore/linkify.ts calls arrayReplaceAt once per linkified text token, and that rebuilds the whole children array each...

Inefficient Algorithmic Complexity

Overview markdown-it is a modern pluggable markdown parser. Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity in the linkify rule src/rulescore/linkify.ts via input containing multiple fuzzy links. The arrayReplaceAt utility was called repeatedly inside the...

@asermax/tachikoma (>=3.67.0, <=3.81.0), @dgtalbug/iris (>=0.3.0-rc.0, <=0.4.0) +35 more potentially affected by unknown CVE via markdown-it (15.0.0)

markdown-it NPM version 15.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on markdown-it and may be impacted: - @asermax/tachikoma =3.67.0, =0.3.0-rc.0, =0.0.12, =0.0.5, =0.16.4, =0.11.4, =0.11.6 and more Source cves: unknown CVE Source advisory:...

@asermax/tachikoma (>=3.67.0, <=3.81.0), @dgtalbug/iris (>=0.3.0-rc.0, <=0.4.0) +35 more potentially affected by unknown CVE via markdown-it (15.0.0)

markdown-it NPM version 15.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on markdown-it and may be impacted: - @asermax/tachikoma =3.67.0, =0.3.0-rc.0, =0.0.12, =0.0.5, =0.16.4, =0.11.4, =0.11.6 and more Source cves: unknown CVE Source advisory:...

The vulnerability of the EcoStruxure IT Data Center Expert software in managing data center infrastructure lies in its ability to be exploited by attackers by introducing or modifying certain arguments, allowing them to execute arbitrary code.

The vulnerability of the software for managing the infrastructure of EcoStruxure IT Data Center Expert is related to the implementation or modification of arguments. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

The vulnerability of the EcoStruxure IT Data Center Expert software in managing data center infrastructure lies in the insufficient validation of requests on the server side. This allows attackers to execute arbitrary commands.

The vulnerability of the software for managing the infrastructure of EcoStruxure IT Data Center Expert is related to insufficient testing of requests on the server side. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

CLSA-2026-1790598013 TuxCare security update for markdown-it (1 CVE)

TuxCare rebuilt markdown-it to address 1 CVE. Fixed in 13.0.2-tuxcare.2...

CLSA-2026-1790520316 TuxCare security update for linkify-it (1 CVE)

TuxCare rebuilt linkify-it to address 1 CVE. Fixed in 2.2.0-tuxcare.1...

PT-2026-107634

TuxCare rebuilt linkify-it to address 1 CVE. Fixed in 2.2.0-tuxcare.1...

EUVD-2026-87288

GLPI is a free asset and IT management software package. From 11.0.5 until 11.0.8, under certain conditions, permission logic can grant access to a document without confirming that the document is linked to the targeted item. A user can use an unrelated item that the user is permitted to view to...

GHSA-396X-XMVH-P563 Snipe-IT: Stored XSS via Inline XML Rendering in the Uploaded Files API

Snipe-IT's uploaded-files API accepts XML documents and later serves them inline without applying the safe-inline allowlist used by the equivalent web controller. An authenticated user who can attach files to a supported object can upload an XSLT stylesheet and an XML document that references it...

Cross-site Scripting (XSS)

Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to Cross-site Scripting XSS through the API's handling of uploaded XML files, which are rendered inline without proper sanitization. An attacker can execute arbitrary JavaScrip...

Snipe-IT: Stored XSS via Inline XML Rendering in the Uploaded Files API

Snipe-IT's uploaded-files API accepts XML documents and later serves them inline without applying the safe-inline allowlist used by the equivalent web controller. An authenticated user who can attach files to a supported object can upload an XSLT stylesheet and an XML document that references it...

GHSA-P9H3-GVPQ-5539 Snipe-IT: Stored XSS via Custom Field name in asset-list column headers

Impact A user with the "customfields.create" permission can store HTML/JS in a Custom Field name, which is later rendered as an asset-list column title WITHOUT escaping at app/Presenters/AssetPresenter.php line 364 'title' = $field-name and injected into the table header by the bundled...

Cross-site Scripting (XSS)

Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the AssetPresenter process. An attacker can execute arbitrary scripts in the context of a higher-privileged user's session by injecting maliciou...

Snipe-IT: Stored XSS via Custom Field name in asset-list column headers

Impact A user with the "customfields.create" permission can store HTML/JS in a Custom Field name, which is later rendered as an asset-list column title WITHOUT escaping at app/Presenters/AssetPresenter.php line 364 'title' = $field-name and injected into the table header by the bundled...

CVE-2026-63493

Snipe-IT is an IT asset/license management system. Prior to 8.7.0, a password-authenticated session for an account with self.api permission can reach the personal-access-token API flow before completing the account's second-factor challenge because CheckForTwoFactor is enforced in the web...

CVE-2026-62368

Snipe-IT is an IT asset/license management system. Prior to 8.7.0, a user with the customfields.create permission can store markup in CustomField.name, and app/Presenters/AssetPresenter.php assigns that value as an unescaped bootstrap-table header title. When another user opens an asset-list page...