CVE-2022-21670: markdown-it_project markdown-it
CVSS: 5.3v3.1MediumModified
AliasesUBUNTU-CVE-2022-21670DEBIAN-CVE-2022-21670GHSA-6vfc-qv3f-vr6c
Published 10-01-2022Last modified 22-04-2025
Vulnerability summary
CVE-2022-21670 is a medium (CVSS 5.3) vulnerability in markdown-it_project markdown-it. EPSS estimates a 2.28% chance of exploitation in the next 30 days, higher than 82.9% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
5.3/10
010
Medium · v3.1 (CVE.org)EPSS score
2.28%
0%100%
Low · +0.09 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1github
Timeline
- 10-01-2022PublishedVulnerability first disclosed.
- 22-04-2025Last modifiedVulnerability information updated.
Description
markdown-it is a Markdown parser. Prior to version 1.3.2, special patterns with length greater than 50 thousand characterss could slow down the parser significantly. Users should upgrade to version 12.3.2 to receive a patch. There are no known workarounds aside from upgrading.
CVSS metrics
7 scores · 6 sources · 2 versionsMedium 5.3Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LSourcesAll 6 agree
- OSV · UbuntuEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- OSV · DebianEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- OSV · NpmEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- NVDNIST5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- wordfenceSource5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Medium 5.0Preferred score · NVD (NIST)
AV:N/AC:L/Au:N/C:N/I:N/A:PSourcesSingle source
EPSS trend
Probability
2.28%
Chance of exploitation in the next 30 days
Percentile
83%
Versus all other CVEs
30-day change
+0.09 pp
From 2.19% on 21-09-2026
21-09-202621-10-2026
EPSS score2.28%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundMarkdown It
Maturity: poc
Weaknesses
CWE · root cause- CWE-1333Inefficient Regular Expression ComplexityThe product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.
- CWE-400Uncontrolled Resource ConsumptionThe product does not properly control the allocation and maintenance of a limited resource.
Affected systems
Debian1 product
- node-markdown-it< 10.0.0+dfsg-6
Markdown-it1 product
- markdown-it< 12.3.2
Markdown-it_project1 product
- markdown-it≤ 12.3.1
Npm1 product
- markdown-it< 12.3.2
Ubuntu1 product
- node-markdown-itAll versions (No fix recorded)
Wordpress1 product
- maps-block-apple1.0.3 (fixed in 1.1.0)
6 vendors · 6 products
References
8 links- github.com/markdown-it/markdown-it/security/advisories/GHSA-6vfc-qv3f-vr6cX Refsource CONFIRMREPORTWEBExploitThird Party Advisory
- github.com/markdown-it/markdown-it/commit/ffc49ab46b5b751cd2be0aabb146f2ef84986101X Refsource MISCREPORTWEBPatchThird Party Advisory
