Skip to content
OpenAdvisories

Package · crates.io

pulldown-cmark

2 known vulnerabilities.

2 results · Feed

  • High 7.5

    Quadratic parsing of nested image wikilinks with `ENABLE_WIKILINKS`

    With `Options::ENABLE_WIKILINKS`, handle_wikilink builds a wikilink's target from the raw text of its body: scan_wikilink_pipe walks it looking for |, then contains('\0') and from_replace_nuls walk it again. Once a wikilink is created, disable_all_links only …

  • High 7.5

    Exponential event growth with `ENABLE_WIKILINKS`

    When `Options::ENABLE_WIKILINKS` is enabled, a wikilink with a pipe separator and empty display text, such as `[[a|]]`, leaks its child node's sibling chain into the content that follows it. Each such link roughly doubles the number of events the parser yield…