Markdown-it: Quadratic-time Denial Of Service In Inline HTML Parsing With Html Enabled

Summary With "html: true", markdown-it takes quadratic time to parse repeated unterminated HTML constructs inside a paragraph. This affects HTML comments "", "?", "", and "". When the terminator is absent, matching fails. Parsing eventually reaches the next opener and scans an overlapping suffix...