Markdown It vulnerabilities
8 vulnerabilities
Known vulnerabilities in Markdown It products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 2 products.
Products
2- Markdown It6 vulnerabilities
- Linkify It2 vulnerabilities
PrioritiseCVE-2026-111758markdown-it +21 moremarkdown-it: Quadratic-time rendering of a single multi-line link reference definition with default options (regression since 14.0)markdown-it is a Markdown parser. From versions 14.1.0 to before 14.3.3, and 15.0.0 to before 15.0.3, a link reference definition whose label or title is never closed is O(n²) with default options. Continuation lines are pulled lazily with str += lineContent in src/rules_block/reference.ts, and the subsequent charCodeAt and slice calls flatten the V8 cons-string, copying everything collected so far; this runs before the rule decides the definition is invalid. No options are required to trigger it. This issue has been patched in versions 14.3.3 and 15.0.3.CVSS7.5HighEPSS0.55%RoutineCVE-2026-111766markdown-it +24 moremarkdown-it: Quadratic-time denial of service in inline HTML parsing with html enabledmarkdown-it is a Markdown parser. Prior to 14.3.3 and 15.0.3, when the html option or commonmark preset is enabled and the constructs occur inside a paragraph, attacker-controlled Markdown containing repeated unterminated inline HTML comments, processing instructions, declarations, or CDATA sections reaches src/rules_inline/html_inline.ts. Its HTML_TAG_RE match searches the remaining suffix for the appropriate terminator; when no terminator is present, parsing advances to the next opener and repeats the match over overlapping input, causing quadratic processing and denial of service through event-loop blocking or an unresponsive browser main thread. HTML blocks and the default HTML-disabled configuration are not affected by these payloads. This issue is fixed in versions 14.3.3 and 15.0.3.CVSS3.7LowEPSS0.43%PrioritiseCVE-2026-111759markdown-it +22 moremarkdown-it: Quadratic complexity in smartquotes with unmatched closing quotesmarkdown-it is a Markdown parser. Prior to 14.3.2 and 15.0.2, when typographer: true is enabled, specially crafted Markdown can cause quadratic processing time in the smartquotes rule, potentially leading to denial of service in applications processing untrusted input. Many opening double quotes followed by unmatched closing single quotes cause repeated scans of the entire opener stack. The same issue occurs with the quote types reversed. The default configuration (typographer: false) is not affected, but this option is enabled with high probability. This issue is fixed in versions 14.3.2 and 15.0.2.CVSS7.5HighEPSS0.59%PrioritiseCVE-2026-48801markdown-it · linkify-it +37 morelinkify-it: Quadratic algorithmic complexity in LinkifyIt#match scan looplinkify-it is a links recognition library with full Unicode support. Prior to 5.0.1, LinkifyIt.prototype.match, the package's primary public API, has O(N²) algorithmic complexity for inputs containing many fuzzy links or emails because the JavaScript-level scan loop re-slices input and re-runs unanchored regex searches on progressively shorter tails. Any service that synchronously renders untrusted Markdown with linkify:true on a request hot path can inherit a worker-process denial of service triggerable by a tens-of-KB request body. This issue is fixed in version 5.0.1.CVSS8.7HighEPSS0.39%PrioritiseCVE-2026-59887markdown-it · linkify-it +29 morelinkify-it: Quadratic-complexity DoS via the `mailto:` validator scan-loop on attacker textlinkify-it is a links recognition library with full Unicode support. Prior to 5.0.2, the mailto: schema validator used by .test() and .match() can be invoked at every mailto: occurrence and scan the remaining input through src_email_name in lib/re.mjs, causing O(n^2) CPU consumption on crafted user text. This issue is fixed in version 5.0.2.CVSS7.5HighEPSS0.47%RoutineCVE-2026-48988markdown-it +44 moremarkdown-it: Quadratic complexity DoS in smartquotes rule via replaceAt string operationsmarkdown-it is a Markdown parser. Versions 14.1.1 and below contain a denial-of-service vulnerability when typographer: true is enabled, due to quadratic (O(n^2)) processing in the smartquotes rule. The issue stems from repeatedly modifying strings with replaceAt(), which performs O(n) slicing and concatenation per quote character. This can cause excessive CPU consumption when parsing quote-heavy, user-supplied markdown and may let attackers degrade or disrupt service availability. Although typographer is disabled by default, many production apps enable it for smart typography, making the issue relevant. This issue has been fixed in version 14.2.0.CVSS5.3MediumEPSS0.38%RoutineCVE-2025-7969markdown-it +3 moreMarkdown-it 14.1.0 - Cross-site scripting (XSS)Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in markdown-it allows Cross-Site Scripting (XSS). This vulnerability is associated with program files lib/renderer.mjs.
This issue affects markdown-it: 14.1.0. NOTE: the Supplier does not consider this issue to be a vulnerability.CVSS6.9MediumEPSS0.25%RoutineCVE-2022-21670markdown-it +5 moreUncontrolled Resource Consumption in markdown-itmarkdown-it is a Markdown parser. Prior to version 1.3.2, special patterns with length greater than 50 thousand characterss could slow down the parser significantly. Users should upgrade to version 12.3.2 to receive a patch. There are no known workarounds aside from upgrading.CVSS5.3MediumEPSS2.36%