4 matches found
CVE-2026-102941
The package github.com/gomarkdown/markdown is a Go library for parsing Markdown text and rendering as HTML. Prior to 0.0.0-20260724235538-61af6e1e6971, parser.IsSafeURL in parser/parser.go slices url:nPath before the lenurl = nPath guard. A short destination causes a slice-bounds panic when the...
EUVD-2026-102934
The package github.com/gomarkdown/markdown is a Go library for parsing Markdown text and rendering as HTML. Prior to 0.0.0-20260724235538-61af6e1e6971, parser.IsSafeURL in parser/parser.go slices url:nPath before the lenurl = nPath guard. A short destination causes a slice-bounds panic when the...
CVE-2026-102941
The github.com/gomarkdown/markdown Go library (prior to version 0.0.0-20260724235538-61af6e1e6971 ) contains a slice-bounds panic in the parser.IsSafeURL function located in parser/parser.go . The root cause is that the code slices url[:nPath] before verifying that len(url) >= nPath. This vuln...
CVE-2026-102941 gomarkdown/markdown IsSafeURL panics on short URLs
The package github.com/gomarkdown/markdown is a Go library for parsing Markdown text and rendering as HTML. Prior to 0.0.0-20260724235538-61af6e1e6971, parser.IsSafeURL in parser/parser.go slices url:nPath before the lenurl = nPath guard. A short destination causes a slice-bounds panic when the...