9598 matches found
CVE-2026-111758
The markdown-it Markdown parser is vulnerable to an algorithmic-complexity denial of service (CWE-407) due to quadratic-time rendering of multi-line link reference definitions. In versions 14.1.0 to before 14.3.3 and 15.0.0 to before 15.0.3 , providing a definition where the label or title is nev...
CVE-2026-111758 markdown-it: Quadratic-time rendering of a single multi-line link reference definition with default options (regression since 14.0)
markdown-it is a Markdown parser. From versions 14.1.0 to before 14.3.3, and 15.0.0 to before 15.0.3, a link reference definition whose label or title is never closed is OnĀ² with default options. Continuation lines are pulled lazily with str += lineContent in src/rulesblock/reference.ts, and the...
GHSA-VFGH-JCMW-G37Q markdown-it: Quadratic-time denial of service in inline HTML parsing with html enabled
Summary With html: true, markdown-it takes quadratic time to parse repeated unterminated HTML constructs inside a paragraph. This affects HTML comments , ?, , and . When the terminator is absent, matching fails. Parsing eventually reaches the next opener and scans an overlapping suffix again...
markdown-it: Quadratic-time denial of service in inline HTML parsing with html enabled
Summary With html: true, markdown-it takes quadratic time to parse repeated unterminated HTML constructs inside a paragraph. This affects HTML comments , ?, , and . When the terminator is absent, matching fails. Parsing eventually reaches the next opener and scans an overlapping suffix again...
EUVD-2026-104595
markdown-it: Quadratic-time denial of service in inline HTML parsing with html enabled...
NPM: markdown-it: Quadratic-time denial of service in inline HTML parsing with html enabled
NPM: markdown-it: Quadratic-time denial of service in inline HTML parsing with html enabled vulnerability discovered by ? in WordPress npm markdown-it versions 14.3.3...
yowie
Yowie āāāāāāāāāāāāā āāāāāāāāāāāāāāāāā Yowie Ā· tracking down the SaaS nobody told you about āāāāāāāāāāāāāāāāāāā āāāā ā ā āāā Domain acme.com.au āāāā ā¼ āāā Candidates acme, acmecorp āāāāā ā°āāāāÆ āāāā āāāāāāāāāāāāāāāāāāā āāāāāāāāāāāāāāā Finds the SaaS services an organisation subscribes to, using onl...
markdown-it: Quadratic complexity in smartquotes with unmatched closing quotes
Impact When typographer: true is enabled, specially crafted Markdown can cause quadratic processing time in the smartquotes rule, potentially leading to denial of service in applications processing untrusted input. Many opening double quotes followed by unmatched closing single quotes cause...
EUVD-2026-104538
markdown-it: Quadratic complexity in smartquotes with unmatched closing quotes...
NPM: markdown-it: Quadratic complexity in smartquotes with unmatched closing quotes
NPM: markdown-it: Quadratic complexity in smartquotes with unmatched closing quotes vulnerability discovered by ? in WordPress npm markdown-it versions 14.3.2...
ROOT-APP-NPM-CVE-2026-48801 CVE-2026-48801 in linkify-it - Patched by Root
Root has patched CVE-2026-48801 in the linkify-it package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2026-59887 CVE-2026-59887 in linkify-it - Patched by Root
Root has patched CVE-2026-59887 in the linkify-it package for Root:npm. Multiple fixed versions available...
Linux Distros Unpatched Vulnerability : CVE-2026-111759
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - markdown-it is a Markdown parser. Prior to 14.3.2 and 15.0.2, when typographer: true is enabled, specially crafted Markdown can cause quadratic processing time ...
PT-2026-118647
Name of the Vulnerable Software and Affected Versions markdown-it versions 14.1.0 through 14.3.2 markdown-it versions 15.0.0 through 15.0.2 Description An algorithmic-complexity denial of service exists when processing a link reference definition with a label or title that is never closed. Using...
CVE-2026-111766
A flaw was found in markdown-it. When HTML parsing is enabled, a remote attacker can cause a Denial of Service DoS by supplying specially crafted Markdown input containing repeated unterminated inline HTML constructs. The parser repeatedly scans overlapping input while searching for closing tags,...
CVE-2026-111759
A flaw was found in markdown-it. A remote attacker can trigger a Denial of Service DoS by submitting specially crafted Markdown input containing numerous mismatched quotation marks when typographer mode is enabled. This input causes the parser to repeatedly rescan quote tokens, resulting in...
DEBIAN-CVE-2026-111766
markdown-it is a Markdown parser. Prior to 14.3.3 and 15.0.3, when the html option or commonmark preset is enabled and the constructs occur inside a paragraph, attacker-controlled Markdown containing repeated unterminated inline HTML comments, processing instructions, declarations, or CDATA...
CVE-2026-111766
markdown-it is a Markdown parser. Prior to 14.3.3 and 15.0.3, when the html option or commonmark preset is enabled and the constructs occur inside a paragraph, attacker-controlled Markdown containing repeated unterminated inline HTML comments, processing instructions, declarations, or CDATA...
CVE-2026-111766 markdown-it: Quadratic-time denial of service in inline HTML parsing with html enabled
markdown-it is a Markdown parser. Prior to 14.3.3 and 15.0.3, when the html option or commonmark preset is enabled and the constructs occur inside a paragraph, attacker-controlled Markdown containing repeated unterminated inline HTML comments, processing instructions, declarations, or CDATA...
CVE-2026-111766
markdown-it is a Markdown parser. Prior to 14.3.3 and 15.0.3, when the html option or commonmark preset is enabled and the constructs occur inside a paragraph, attacker-controlled Markdown containing repeated unterminated inline HTML comments, processing instructions, declarations, or CDATA...