Markdown-it: Quadratic-time Denial Of Service In Inline HTML Parsing With Html Enabled

Summary With "html: true", markdown-it takes quadratic time to parse repeated unterminated HTML constructs inside a paragraph. This affects HTML comments "", "?", "", and "". When the terminator is absent, matching fails. Parsing eventually reaches the next opener and scans an overlapping suffix...

GHSA-VFGH-JCMW-G37Q markdown-it: Quadratic-time denial of service in inline HTML parsing with html enabled

Summary With html: true, markdown-it takes quadratic time to parse repeated unterminated HTML constructs inside a paragraph. This affects HTML comments , ?, , and . When the terminator is absent, matching fails. Parsing eventually reaches the next opener and scans an overlapping suffix again...

npm: markdown-it: Quadratic-time denial of service in inline HTML parsing with html enabled

npm: markdown-it: Quadratic-time denial of service in inline HTML parsing with html enabled vulnerability discovered by ? in WordPress npm markdown-it versions 14.3.3...