306 matches found
CLSA-2026-1791666427 TuxCare security update for markdown-it (1 CVE)
TuxCare rebuilt markdown-it to address 1 CVE. Fixed in 4.0.3-tuxcare.3...
CLSA-2026-1791626468 TuxCare security update for markdown-it (1 CVE)
TuxCare rebuilt markdown-it to address 1 CVE. Fixed in 4.3.0-tuxcare.4...
OPENSUSE-SU-2026:12015-1 python313-markdown-it-py-4.2.0-1.2 on GA media
These are all security issues fixed in the python313-markdown-it-py-4.2.0-1.2 package on the GA media of openSUSE Tumbleweed...
PT-2026-105724
These are all security issues fixed in the python313-markdown-it-py-4.2.0-1.2 package on the GA media of openSUSE Tumbleweed...
Security Bulletin: Vulnerability in markdown-it package bundled with IBM Fusion, IBM Fusion HCI, IBM Fusion Data Cataloging and IBM Fusion Content-Aware Storage.
Summary IBM Fusion, IBM Fusion HCI, IBM Fusion Data Cataloging, and IBM Fusion Content-Aware Storage include the markdown-it library, which is affected by a denial of service vulnerability. CVE-2026-2327. Vulnerability Details CVEID:CVE-2026-2327 DESCRIPTION: Versions of the package markdown-it...
CLSA-2026-1790755985 TuxCare security update for markdown-it (1 CVE)
TuxCare rebuilt markdown-it to address 1 CVE. Fixed in 13.0.2-tuxcare.3...
NPM: markdown-it linkify: true has two quadratic paths, so a few hundred KB of markdown blocks the event loop for tens of seconds
NPM: markdown-it linkify: true has two quadratic paths, so a few hundred KB of markdown blocks the event loop for tens of seconds vulnerability discovered by ? in WordPress Npm markdown-it versions 14.3.1...
@asermax/tachikoma (>=3.67.0, <=3.81.0), @dgtalbug/iris (>=0.3.0-rc.0, <=0.4.0) +35 more potentially affected by unknown CVE via markdown-it (15.0.0)
markdown-it NPM version 15.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on markdown-it and may be impacted: - @asermax/tachikoma =3.67.0, =0.3.0-rc.0, =0.0.12, =0.0.5, =0.16.4, =0.11.4, =0.11.6 and more Source cves: unknown CVE Source advisory:...
@0xwork/connect (>=0.1.8, <=0.1.9), @7n/rules (>=1.0.0, <=1.118.11) +528 more potentially affected by unknown CVE via markdown-it (>=14.0.0, <=14.3.0)
markdown-it NPM version =14.0.0, =0.1.8, =1.0.0, =2026.6.2, =4.10.0, =2026.5.2-zh, =1.0.0, =5.52.1-fa.2, =5.52.1-fa.2, =2.3.0, =2.24.0 - @amap-lbs/amap-a2ui 0.1.0 - @apilium/mayros-matrix 0.1.1 and more Source cves: unknown CVE Source advisory: SNYK:JS-MARKDOWNIT-20335431...
@asermax/tachikoma (>=3.67.0, <=3.81.0), @dgtalbug/iris (>=0.3.0-rc.0, <=0.4.0) +35 more potentially affected by unknown CVE via markdown-it (15.0.0)
markdown-it NPM version 15.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on markdown-it and may be impacted: - @asermax/tachikoma =3.67.0, =0.3.0-rc.0, =0.0.12, =0.0.5, =0.16.4, =0.11.4, =0.11.6 and more Source cves: unknown CVE Source advisory:...
markdown-it linkify: true has two quadratic paths, so a few hundred KB of markdown blocks the event loop for tens of seconds
Summary Two independent quadratic paths in the linkify: true handling. Both are in markdown-it's own code rather than in linkify-it, which stays linear on both payloads. src/rulescore/linkify.ts calls arrayReplaceAt once per linkified text token, and that rebuilds the whole children array each...
@0xwork/connect (>=0.1.8, <=0.1.9), @7n/rules (>=1.0.0, <=1.118.11) +528 more potentially affected by unknown CVE via markdown-it (>=14.0.0, <=14.3.0)
markdown-it NPM version =14.0.0, =0.1.8, =1.0.0, =2026.6.2, =4.10.0, =2026.5.2-zh, =1.0.0, =5.52.1-fa.2, =5.52.1-fa.2, =2.3.0, =2.24.0 - @amap-lbs/amap-a2ui 0.1.0 - @apilium/mayros-matrix 0.1.1 and more Source cves: unknown CVE Source advisory: GHSA-253C-MCHW-3W2R...
GHSA-253C-MCHW-3W2R markdown-it linkify: true has two quadratic paths, so a few hundred KB of markdown blocks the event loop for tens of seconds
Summary Two independent quadratic paths in the linkify: true handling. Both are in markdown-it's own code rather than in linkify-it, which stays linear on both payloads. src/rulescore/linkify.ts calls arrayReplaceAt once per linkified text token, and that rebuilds the whole children array each...
@0xwork/connect (>=0.1.8, <=0.1.9), @7n/rules (>=1.0.0, <=1.118.11) +528 more potentially affected by unknown CVE via markdown-it (>=14.0.0, <=14.3.0)
markdown-it NPM version =14.0.0, =0.1.8, =1.0.0, =2026.6.2, =4.10.0, =2026.5.2-zh, =1.0.0, =5.52.1-fa.2, =5.52.1-fa.2, =2.3.0, =2.24.0 - @amap-lbs/amap-a2ui 0.1.0 - @apilium/mayros-matrix 0.1.1 and more Source cves: unknown CVE Source advisory: OSV:GHSA-253C-MCHW-3W2R...
@asermax/tachikoma (>=3.67.0, <=3.81.0), @dgtalbug/iris (>=0.3.0-rc.0, <=0.4.0) +35 more potentially affected by unknown CVE via markdown-it (15.0.0)
markdown-it NPM version 15.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on markdown-it and may be impacted: - @asermax/tachikoma =3.67.0, =0.3.0-rc.0, =0.0.12, =0.0.5, =0.16.4, =0.11.4, =0.11.6 and more Source cves: unknown CVE Source advisory:...
Inefficient Algorithmic Complexity
Overview markdown-it is a modern pluggable markdown parser. Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity in the linkify rule src/rulescore/linkify.ts via input containing multiple fuzzy links. The arrayReplaceAt utility was called repeatedly inside the...
CLSA-2026-1790598013 TuxCare security update for markdown-it (1 CVE)
TuxCare rebuilt markdown-it to address 1 CVE. Fixed in 13.0.2-tuxcare.2...
CLSA-2026-1790161417 TuxCare security update for markdown-it (1 CVE)
TuxCare rebuilt markdown-it to address 1 CVE. Fixed in 4.4.0-tuxcare.2...