CVE-2026-2327

The CVE-2026-2327 case concerns the markdown-it package. Affected versions: 13.0.0 through 14.1.0 (and up to 14.1.1 as fixed) are vulnerable to a Regular Expression Denial of Service in the linkify function due to the regex /*$/ used for links; an attacker can provide a long sequence of * follow...

Markdown-It 安全漏洞

Markdown-It is an open-source Markdown parser. Versions of Markdown-It prior to 14.1.1 contained a security vulnerability. This vulnerability stemmed from the use of regular expressions in the linkify function, which could lead to a denial-of-service attack due to the regular expressions...

PT-2026-7818

Name of the Vulnerable Software and Affected Versions markdown-it versions 13.0.0 through 14.1.0 Description The software is susceptible to a Regular Expression Denial of Service ReDoS condition. This occurs due to the use of the regular expression /+$/ within the linkify function. An attacker ca...

EUVD-2025-22758

Malicious code in bioql PyPI...

EUVD-2024-48318

Malicious code in bioql PyPI...

Cross-site Scripting (XSS)

Linkify is vulnerable to Cross-site Scripting XSS. The vulnerability is due to improperly controlled modification of object prototype attributes due to insufficient validation of user-controlled input, which can lead to XSS and manipulation of application variables...

Prototype Pollution

Overview linkify-react is a React element interface for linkifyjs Affected versions of this package are vulnerable to Prototype Pollution via the internal assign helper due to improper filtering of the proto property. An attacker can achieve Stored or Reflected XSS by injecting event handlers int...

Prototype Pollution

Overview linkifyjs is a Find URLs, email addresses, hashtags and @mentions in plain-text strings, then convert them into HTML links. Affected versions of this package are vulnerable to Prototype Pollution via the internal assign helper due to improper filtering of the proto property. An attacker...

@a.agiir/cinny (>=0.0.1 <=0.0.2), @a1tan/plugin-azure-openai (=0.4.0) +786 more potentially affected by CVE-2025-8101 via linkify-react (>=4.0.0-beta.4 <=4.3.1)

linkify-react NPM version =4.0.0-beta.4, =0.0.1, =0.1.0, =0.1.0, =1.0.0, =0.1.8, =0.1.10 - @alithya-oss/backstage-plugin-rag-ai =1.2.7 - @alithya-oss/backstage-plugin-time-saver =1.4.5 and more Source cves: CVE-2025-8101 Source advisory: SNYK:JS-LINKIFYREACT-11502190...

Prototype Pollution

Overview org.webjars.bower:linkifyjs is a Find URLs, email addresses, hashtags and @mentions in plain-text strings, then convert them into HTML links. Affected versions of this package are vulnerable to Prototype Pollution via the internal assign helper due to improper filtering of the proto...

GHSA-95JQ-XPH2-CX9H Linkify Allows Prototype Pollution & HTML Attribute Injection (XSS)

Prototype Pollution in internal assign helper in Linkify allows remote attackers to execute arbitrary JavaScript Stored or Reflected XSS via injection of event handlers through unfiltered proto property. This issue affects Linkify version 4.3.1 and is fixed in 4.3.2...

Linkify Allows Prototype Pollution & HTML Attribute Injection (XSS)

Prototype Pollution in internal assign helper in Linkify allows remote attackers to execute arbitrary JavaScript Stored or Reflected XSS via injection of event handlers through unfiltered proto property. This issue affects Linkify version 4.3.1 and is fixed in 4.3.2...

CVE-2025-8101

Improperly Controlled Modification of Object Prototype Attributes 'Prototype Pollution' vulnerability in Linkify linkifyjs allows XSS Targeting HTML Attributes and Manipulating User-Controlled Variables.This issue affects Linkify: from 4.3.1 before 4.3.2...

CVE-2025-8101 Linkify 4.3.1 - Prototype Pollution & HTML Attribute Injection (XSS)

Improperly Controlled Modification of Object Prototype Attributes 'Prototype Pollution' vulnerability in Linkify linkifyjs allows XSS Targeting HTML Attributes and Manipulating User-Controlled Variables.This issue affects Linkify: from 4.3.1 before 4.3.2...

CVE-2025-8101 Linkify 4.3.1 - Prototype Pollution & HTML Attribute Injection (XSS)

Improperly Controlled Modification of Object Prototype Attributes 'Prototype Pollution' vulnerability in Linkify linkifyjs allows XSS Targeting HTML Attributes and Manipulating User-Controlled Variables.This issue affects Linkify: from 4.3.1 before 4.3.2...

CVE-2025-8101

CVE-2025-8101 affects the Linkify library (linkifyjs). It is a prototype pollution vulnerability in Linkify from version 4.3.1 prior to 4.3.2, enabling manipulation of Object.prototype and potential HTML attribute injection leading to XSS. The issue stems from improper handling of the proto path ...

CVE-2025-8101 Linkify 4.3.1 - Prototype Pollution & HTML Attribute Injection (XSS)

Improperly Controlled Modification of Object Prototype Attributes 'Prototype Pollution' vulnerability in Linkify linkifyjs allows XSS Targeting HTML Attributes and Manipulating User-Controlled Variables.This issue affects Linkify: from 4.3.1 before 4.3.2...

Linkify 安全漏洞

Linkify is an open source plugin for Linkify. A security vulnerability exists in Linkify versions prior to 4.3.1 through 4.3.2 that stems from prototype contamination and is vulnerable to cross-site scripting attacks...

PT-2025-30937

Name of the Vulnerable Software and Affected Versions Linkify versions 4.3.1 through 4.3.2 Description The software contains an improperly controlled modification of object prototype attributes 'Prototype Pollution' issue. This can lead to cross-site scripting XSS attacks targeting HTML attribute...

Regular Expression Denial of Service (ReDoS)

Overview markdown-it is a modern pluggable markdown parser. Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS due to the use of the regex /+$/ in the linkify function. An attacker can supply a long sequence of characters followed by a non-matching...