Skip to content
OpenAdvisories

Package · npm

markdown-it

8 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 7.5
    CVE-2026-111758

    markdown-it: Quadratic-time rendering of a single multi-line link reference definition with default options (regression since 14.0)

    markdown-it is a Markdown parser. From versions 14.1.0 to before 14.3.3, and 15.0.0 to before 15.0.3, a link reference definition whose label or title is never closed is O(n²) with default options. Continuation lines are pulled lazily with str += lineContent …

    markdown-it markdown-it node-markdown-it markdown-it Ubuntu npm
  • High 7.5
    CVE-2026-111759

    markdown-it: Quadratic complexity in smartquotes with unmatched closing quotes

    markdown-it is a Markdown parser. Prior to 14.3.2 and 15.0.2, when typographer: true is enabled, specially crafted Markdown can cause quadratic processing time in the smartquotes rule, potentially leading to denial of service in applications processing untrus…

    markdown-it markdown-it node-markdown-it markdown-it Debian Ubuntu npm