CVE-2026-40890highCWE-125

CVE-2026-40890: falha de alta gravidade em gomarkdown markdown

github.com/gomarkdown/markdown: Out-of-bounds Read in SmartypantsRenderer

Publicada em

Seguir esta CVE+ Monitorar markdown+ Monitorar golang-github-gomarkdown-markdown

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.5epss 0.3%
The package `github.com/gomarkdown/markdown` is a Go library for parsing Markdown text and rendering as HTML. Processing a malformed input containing a < character that is not followed by a > character anywhere in the remaining text with a SmartypantsRenderer will lead to Out of Bounds read or a panic. This vulnerability is fixed with commit 759bbc3e32073c3bc4e25969c132fc520eda2778.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Produtos afetados
gomarkdown · markdown
CVEs relacionadas — gomarkdown markdown

No mesmo produto, das mais perigosas para as menos.

CVE-2023-42821HIGHgithub.com/gomarkdown/markdown Out-of-bounds Read while parsing citationsEPSS 1.3%CVE-2026-102941HIGHgomarkdown/markdown IsSafeURL panics on short URLsEPSS 0.3%