CVE-2026-111758highCWE-400CWE-407

CVE-2026-111758: falha de alta gravidade em markdown-it

markdown-it: Quadratic-time rendering of a single multi-line link reference definition with default options (regression since 14.0)

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar markdown-it+ Monitorar markdown-it

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.5epss 0.5%
markdown-it is a Markdown parser. From versions 14.1.0 to before 14.3.3, and 15.0.0 to before 15.0.3, a link reference definition whose label or title is never closed is O(n²) with default options. Continuation lines are pulled lazily with str += lineContent in src/rules_block/reference.ts, and the subsequent charCodeAt and slice calls flatten the V8 cons-string, copying everything collected so far; this runs before the rule decides the definition is invalid. No options are required to trigger it. This issue has been patched in versions 14.3.3 and 15.0.3.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Produtos afetados
markdown-it · markdown-it
CVEs relacionadas — markdown-it

No mesmo produto, das mais perigosas para as menos.

CVE-2022-21670MEDIUMUncontrolled Resource Consumption in markdown-itEPSS 2.4%CVE-2026-111759HIGHmarkdown-it: Quadratic complexity in smartquotes with unmatched closing quotesEPSS 0.6%CVE-2026-111766LOWmarkdown-it: Quadratic-time denial of service in inline HTML parsing with html enabledEPSS 0.4%CVE-2026-48988MEDIUMmarkdown-it: Quadratic complexity DoS in smartquotes rule via replaceAt string operationsEPSS 0.4%CVE-2025-7969MEDIUMMarkdown-it 14.1.0 - Cross-site scripting (XSS)EPSS 0.3%