gomarkdown/markdown IsSafeURL panics on short URLs

Summary IsSafeURL slices url:nPath before checking that lenurl = nPath, so a URL shorter than a path prefix 0, 1 or 2 bytes triggers a slice-bounds panic, and this is reached end to end when the html.Safelink hardening flag is enabled and the input contains an empty or very short link destination...

CVE-2026-102941

The github.com/gomarkdown/markdown Go library (prior to version 0.0.0-20260724235538-61af6e1e6971 ) contains a slice-bounds panic in the parser.IsSafeURL function located in parser/parser.go . The root cause is that the code slices url[:nPath] before verifying that len(url) >= nPath. This vuln...

CVE-2026-102941 gomarkdown/markdown IsSafeURL panics on short URLs

The package github.com/gomarkdown/markdown is a Go library for parsing Markdown text and rendering as HTML. Prior to 0.0.0-20260724235538-61af6e1e6971, parser.IsSafeURL in parser/parser.go slices url:nPath before the lenurl = nPath guard. A short destination causes a slice-bounds panic when the...