CVE-2026-48988

markdown-it is a Markdown parser. Versions 14.1.1 and below contain a denial-of-service vulnerability when typographer: true is enabled, due to quadratic On^2 processing in the smartquotes rule. The issue stems from repeatedly modifying strings with replaceAt, which performs On slicing and...

CVE-2026-48988: Uncontrolled Resource Consumption

markdown-it is a Markdown parser. Versions 14.1.1 and below contain a denial-of-service vulnerability when typographer: true is enabled, due to quadratic On^2 processing in the smartquotes rule. The issue stems from repeatedly modifying strings with replaceAt, which performs On slicing and...

@0xwork/connect (0.1.8), @7n/rules (>=1.0.0, <=1.118.11) +432 more potentially affected by CVE-2026-48988 via markdown-it (>=14.0.0, <=14.1.1)

markdown-it NPM version =14.0.0, =1.0.0, =4.10.0, =2026.5.2-zh, =2.3.0, =1.0.0, =0.25.7, =0.12.2, =3.0.0, =0.1.1, =0.1.1, =8.1.3, =0.1.0, =0.2.2 - @blade-hq/agent-react 2612.0.0-beta.8 and more Source cves: CVE-2026-48988 Source advisory: OSV:GHSA-6V5V-WF23-FMFQ...

markdown-it: Quadratic complexity DoS in smartquotes rule via replaceAt string operations

Summary A quadratic time complexity vulnerability exists in markdown-it's smartquotes rule enabled via the typographer: true option. An attacker can craft a markdown input consisting of consecutive quotation marks that causes the parser to consume excessive CPU time, leading to denial of service...

Inefficient Algorithmic Complexity

Overview markdown-it is a modern pluggable markdown parser. Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the replaceAt function in the smartquotes rule when processing markdown input with a large number of consecutive quotation marks and the...

@0xwork/connect (0.1.8), @7n/rules (>=1.0.0, <=1.118.11) +432 more potentially affected by CVE-2026-48988 via markdown-it (>=14.0.0, <=14.1.1)

markdown-it NPM version =14.0.0, =1.0.0, =4.10.0, =2026.5.2-zh, =2.3.0, =1.0.0, =0.25.7, =0.12.2, =3.0.0, =0.1.1, =0.1.1, =8.1.3, =0.1.0, =0.2.2 - @blade-hq/agent-react 2612.0.0-beta.8 and more Source cves: CVE-2026-48988 Source advisory: GHSA-6V5V-WF23-FMFQ...

GHSA-6V5V-WF23-FMFQ markdown-it: Quadratic complexity DoS in smartquotes rule via replaceAt string operations

Summary A quadratic time complexity vulnerability exists in markdown-it's smartquotes rule enabled via the typographer: true option. An attacker can craft a markdown input consisting of consecutive quotation marks that causes the parser to consume excessive CPU time, leading to denial of service...

@0xwork/connect (0.1.8), @7n/rules (>=1.0.0, <=1.118.11) +432 more potentially affected by CVE-2026-48988 via markdown-it (>=14.0.0, <=14.1.1)

markdown-it NPM version =14.0.0, =1.0.0, =4.10.0, =2026.5.2-zh, =2.3.0, =1.0.0, =0.25.7, =0.12.2, =3.0.0, =0.1.1, =0.1.1, =8.1.3, =0.1.0, =0.2.2 - @blade-hq/agent-react 2612.0.0-beta.8 and more Source cves: CVE-2026-48988 Source advisory: SNYK:JS-MARKDOWNIT-17353909...

Inefficient Algorithmic Complexity

Overview org.webjars.npm:markdown-it is a modern pluggable markdown parser. Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the replaceAt function in the smartquotes rule when processing markdown input with a large number of consecutive quotation mar...

NPM: markdown-it: Quadratic complexity DoS in smartquotes rule via replaceAt string operations

NPM: markdown-it: Quadratic complexity DoS in smartquotes rule via replaceAt string operations vulnerability discovered by ? in WordPress Npm markdown-it versions = 14.1.1...

PT-2026-49555

Name of the Vulnerable Software and Affected Versions markdown-it affected versions not specified Description A quadratic time complexity issue exists in the smartquotes rule when the typographer: true option is enabled. An attacker can provide markdown input containing a large number of...

CVE-2026-48988

creationtimestamp| type| source ---|---|--- 2026-05-23 23:47:27+00:00| published-proof-of-concept| https://github.com/markdown-it/markdown-it/security/advisories/GHSA-6v5v-wf23-fmfq 2026-06-17 22:39:57+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mojeymb5ll2z...

42-markdown (>=1.0.0, <=1.0.1), @58fe/p5 (>=1.3.1, <=2.4.8) +415 more potentially affected by unknown CVE via markdown-it-katex (>=1.1.0, <=2.0.3)

markdown-it-katex NPM version =1.1.0, =1.0.0, =1.3.1, =2.3.0, =0.0.1, =0.0.1, =0.0.1, =1.0.0, =3.0.0, =0.14.0, =1.1.7, =1.0.0, =1.5.0 and more Source cves: unknown CVE Source advisory: MEND:WS-2020-0101...

WS-2020-0101

markdown-it-katex through 2.0.3 is vulnerable to Cross-Site Scripting XSS. The package fails to properly escape error messages, which may allow attackers to execute arbitrary JavaScript in a victim's browser by triggering an error...

WS-2019-0156

markdown-it-toc-and-anchor before 4.2.0 Parsing markdown containing text+\n@toc causes the application to enter and infinite loop...

@aconex/styleguide (>=2.0.1, <=2.2.0), alinex-report (>=1.0.2, <=1.3.14) potentially affected by unknown CVE via markdown-it-toc-and-anchor (>=2.0.0, <=4.1.2)

markdown-it-toc-and-anchor NPM version =2.0.0, =2.0.1, =1.0.2, =1.3.14 Source cves: unknown CVE Source advisory: MEND:WS-2019-0156...

CVE-2026-32626: Improper Neutralization of Input During Web Page Generation

AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. In 1.11.1 and earlier, AnythingLLM Desktop contains a Streaming Phase XSS vulnerability in the chat rendering pipeline that escalates to Remote Code Execution on the host OS...

CVE-2026-29082

Kestra is an event-driven orchestration platform. In versions from 1.1.10 and prior, Kestra’s execution-file preview renders user-supplied Markdown .md with markdown-it instantiated as html:true and injects the resulting HTML with Vue’s v-html without sanitisation. At time of publication, there a...

EUVD-2026-10046

Kestra is an event-driven orchestration platform. In versions from 1.1.10 and prior, Kestra’s execution-file preview renders user-supplied Markdown .md with markdown-it instantiated as html:true and injects the resulting HTML with Vue’s v-html without sanitisation. At time of publication, there a...

CVE-2026-29082 Kestra: Stored Cross-Site Scripting in Markdown File Preview

Kestra is an event-driven orchestration platform. In versions from 1.1.10 and prior, Kestra’s execution-file preview renders user-supplied Markdown .md with markdown-it instantiated as html:true and injects the resulting HTML with Vue’s v-html without sanitisation. At time of publication, there a...