NPM: markdown-it: Quadratic-time denial of service in inline HTML parsing with html enabled

NPM: markdown-it: Quadratic-time denial of service in inline HTML parsing with html enabled vulnerability discovered by ? in WordPress Npm markdown-it versions 14.3.3...

GHSA-VFGH-JCMW-G37Q markdown-it: Quadratic-time denial of service in inline HTML parsing with html enabled

Summary With html: true, markdown-it takes quadratic time to parse repeated unterminated HTML constructs inside a paragraph. This affects HTML comments , ?, , and . When the terminator is absent, matching fails. Parsing eventually reaches the next opener and scans an overlapping suffix again...