Description
A security flaw has been discovered in mixmark-io turndown up to 7.2.1. This affects an unknown function of the file src/commonmark-rules.js. Performing manipulation results in inefficient regular expression complexity. It is possible to initiate the attack remotely. The exploit has been released to the public and may be exploited.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| mixmark-io | turndown | 7.2.0, 7.2.1 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | node-turndown | 7.2.2+~2.2.0~git20240406-1 | — |
| Debian 13 | node-turndown | No fix yet | — |
| Debian 12 | node-turndown | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | node-turndown | No fix yet | — |
| Ubuntu 26.04 LTS | node-turndown | No fix yet | — |
| Ubuntu 25.10 | node-turndown | No fix yet | — |
| Ubuntu 24.04 LTS | node-turndown | No fix yet | — |
| Ubuntu 22.04 LTS | node-turndown | No fix yet | — |
Advisories 3
- ICSA-26-071-03 Siemens SIDIS Prime CISA ICS & IT advisories · Mar 12, 2026
- NCSC-2026-0079 Kwetsbaarheden verholpen in Siemens producten NCSC-NL (Netherlands) · Mar 10, 2026
- SSA-485750 SSA-485750: Multiple Vulnerabilities in SIDIS Prime Before V4.0.800 Siemens ProductCERT · Mar 10, 2026
References
- VDB-321880 | mixmark-io turndown commonmark-rules.js redos vdb-entry
- VDB-321880 | CTI Indicators (IOB, IOC, TTP, IOA) signature permissions-required
- Submit #637911 | turndown npm v7.2.1 Inefficient Regular Expression Complexity third-party-advisory
- https://github.com/mixmark-io/turndown/issues/501 issue-tracking
- https://github.com/mixmark-io/turndown/issues/501#issue-3336342088 exploit issue-tracking