CVE-2026-102941

The package github.com/gomarkdown/markdown is a Go library for parsing Markdown text and rendering as HTML. Prior to 0.0.0-20260724235538-61af6e1e6971, parser.IsSafeURL in parser/parser.go slices url:nPath before the lenurl = nPath guard. A short destination causes a slice-bounds panic when the...

CVE-2026-102941 gomarkdown/markdown IsSafeURL panics on short URLs

The package github.com/gomarkdown/markdown is a Go library for parsing Markdown text and rendering as HTML. Prior to 0.0.0-20260724235538-61af6e1e6971, parser.IsSafeURL in parser/parser.go slices url:nPath before the lenurl = nPath guard. A short destination causes a slice-bounds panic when the...

loot-me

linux-loot Post Exploit Report Generation. Grabs files / commands and puts them in markdown ready for reporting and assists in finding sensitive information...

TJ-OPT

TJ-OPT Release Date September 9th 2024 Introduction As a pentester, there are many great resources, cheat sheets, and guidelines that contain a large amount of valuable information. However, it can be frustrating and time-consuming to find these notes or resources that are scattered all over the...

UBUNTU-CVE-2026-88753

A Regular-Expression Denial of Service ReDoS in the Markdown2. extractmetadata function lib/markdown2.py of trentm markdown2 through v2.5.5 allows attackers to cause a Denial of Service DoS via a crafted Markdown document...

CVE-2026-20841

CVE-2026-20841 This content corresponds to a part of what is provided through the Monthly Report for PatchPoint subscribers. Overview Microsoft disclosed a patch for an RCE vulnerability in Notepad in February 2026. The vulnerability is a Command Injection vulnerability that occurs in Notepad,...

markdown-exfil-tester

valtik-markdown-exfil-tester Black-box tester for indirect prompt injection leading to markdown / HTML exfiltration in LLM-backed chatbots. This is the vulnerability class that hit Microsoft 365 Copilot CVE-2025-32711, aka EchoLeak, ChatGPT OpenAI Feb 2026 patch, and Salesforce ForcedLeak. The...

CVE-2026-20841

CVE-2026-20841 - Windows Notepad RCE PoC for a remote code execution flaw in Windows Notepad's markdown renderer. The markdown engine does not restrict URL protocols, allowing arbitrary protocol handlers to be triggered via clickable links. Disclaimers 1. Not my discovery. Credit goes to the...

CVE-2026-20841

CVE-2026-20841 - Windows Notepad RCE PoC for a remote code execution flaw in Windows Notepad's markdown renderer. The markdown engine does not restrict URL protocols, allowing arbitrary protocol handlers to be triggered via clickable links. Disclaimers 1. Not my discovery. Credit goes to the...

CVE-2026-57568

Lychee is a free, open-source photo-management tool. Prior to 7.6.0, Lychee permits an authenticated user with album-edit permissions to store a javascript URI in an album or photo Markdown description because config/markdown.php enables allowunsafelinks...

PoC-CVE-2026-20841

PoC CVE-2026-20841 Description This project is a simple Proof of Concept PoC regarding Windows Notepad vulnerability about "remote code execution". Attackers have the ability to build a special .md file and by tricking users with Social Engineering skills into clicking the link within the .md fil...

CVE-2026-57568

The photo-management tool Lychee is vulnerable to Stored XSS in versions prior to 7.6.0 . The root cause is that config/markdown.php enables allow_unsafe_links, allowing authenticated users with album-edit permissions to store javascript: URIs in photo or album Markdown descriptions. These descri...

CVE-2026-57568 Lychee: Stored XSS via Markdown javascript: Links in Photo and Album Descriptions (Gallery View)

Lychee is a free, open-source photo-management tool. Prior to 7.6.0, Lychee permits an authenticated user with album-edit permissions to store a javascript URI in an album or photo Markdown description because config/markdown.php enables allowunsafelinks...

CVE-2026-57568 Lychee: Stored XSS via Markdown javascript: Links in Photo and Album Descriptions (Gallery View)

Lychee is a free, open-source photo-management tool. Prior to 7.6.0, Lychee permits an authenticated user with album-edit permissions to store a javascript URI in an album or photo Markdown description because config/markdown.php enables allowunsafelinks...

DEBIAN-CVE-2026-88753

A Regular-Expression Denial of Service ReDoS in the Markdown2. extractmetadata function lib/markdown2.py of trentm markdown2 through v2.5.5 allows attackers to cause a Denial of Service DoS via a crafted Markdown document...

CVE-2026-88753

A Regular-Expression Denial of Service ReDoS in the Markdown2. extractmetadata function lib/markdown2.py of trentm markdown2 through v2.5.5 allows attackers to cause a Denial of Service DoS via a crafted Markdown document...

gitbook-xss

gitbook-xss CVE-2019-19596 GitBook through 2.6.9 allows XSS via a local .md file By entering script in MD file, it can be executed by gitbook...

CVE-2026-20841

CVE-2026-20841 PoC PoC of the "Windows Notepad RCE" vulnerability. Disclaimers 1. I am NOT the one who discovered this vulnerability. Props to the original authors listed on the official disclosure page. I just recreated the PoC according to the description. 2. I personally don't think this...

PYSEC-2026-4290 Pydantic AI: Excessive resource use when local web fetching converts nested HTML

Summary Applications using Pydantic AI's local web-fetch tool can experience excessive CPU and memory use when it converts attacker-controlled HTML. An agent must fetch the affected page; provider-native web fetching is not affected. Details Nested block elements cause HTML-to-Markdown conversion...

PYSEC-2026-4286 Pydantic AI: Event loop blocked by quadratic title extraction in `web_fetch`

Summary The local web-fetch tool webfetchtool, also used as the WebFetch capability's local fallback processed responses with several steps whose running time grows quadratically with the size of certain server-controlled inputs, and ran them on the event loop: decoding the body with whichever...