HTML RDiscount Buffer Overflow DoS

The vulnerability of the document converter in Markdown syntax in HTML RDiscount is related to the execution of operations beyond the buffer boundaries in memory. Exploiting this vulnerability could allow a malicious actor to cause service failures...

CVE-2026-54889 Unsanitized URL schemes in MDEx Quill Delta output allow javascript: injection (XSS)

Improper Neutralization of Input During Web Page Generation XSS vulnerability in leandrocp mdex allows cross-site scripting via unsanitized URL schemes in Quill Delta output. 'Elixir.MDEx':todelta/2 converts Markdown into a Quill Delta. 'Elixir.MDEx.DeltaConverter':defaultconvertnode/3 in...

CVE-2025-60312

Sourcecodester Markdown to HTML Converter v1.0 is vulnerable to a Cross-Site Scripting XSS in the "Markdown Input" field, allowing a remote attacker to inject arbitrary HTML/JavaScript code that executes in the victim's browser upon clicking the "Convert to HTML" button...

@mdn/markdown-converter (0.0.1), rucken (>=4.11.2, <=4.16.1) potentially affected by CVE-2024-21528 via node-gettext (3.0.0)

node-gettext NPM version 3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on node-gettext and may be impacted: - @mdn/markdown-converter 0.0.1 - rucken =4.11.2, =4.16.1 Source cves: CVE-2024-21528 Source advisory: OSV:GHSA-G974-HXVM-X689...

@mdn/markdown-converter (0.0.1), rucken (>=4.11.2, <=4.16.1) potentially affected by CVE-2024-21528 via node-gettext (3.0.0)

node-gettext NPM version 3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on node-gettext and may be impacted: - @mdn/markdown-converter 0.0.1 - rucken =4.11.2, =4.16.1 Source cves: CVE-2024-21528 Source advisory: GHSA-G974-HXVM-X689...

Regular Expression Denial of Service (ReDoS)

Overview org.webjars.bowergithub.showdownjs:showdown is a JavaScript Markdown to HTML converter. Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS in the anchors subparser in anchors.js AKA links.js. PoC time node -e '/?:^|^\ ??:\n...