Suggestions search

All statuses

Filter by:

With package: python312Packages.markdown-it-py

Found 3 matching suggestions

View:

Compact

Detailed

Untriaged

Permalink CVE-2026-48988

5.3 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): None (N)
Availability (A): Low (L)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): Low (L)

created 3 weeks, 6 days ago Activity log

Created suggestion 3 weeks, 6 days ago

markdown-it: Quadratic complexity DoS in smartquotes rule via replaceAt string operations

markdown-it is a Markdown parser. Versions 14.1.1 and below contain a denial-of-service vulnerability when typographer: true is enabled, due to quadratic (O(n^2)) processing in the smartquotes rule. The issue stems from repeatedly modifying strings with replaceAt(), which performs O(n) slicing and concatenation per quote character. This can cause excessive CPU consumption when parsing quote-heavy, user-supplied markdown and may let attackers degrade or disrupt service availability. Although typographer is disabled by default, many production apps enable it for smart typography, making the issue relevant. This issue has been fixed in version 14.2.0.

References

https://github.com/markdown-it/markdown-it/security/advisories/GHSA-6v5v-wf23-fmfq x_refsource_CONFIRM
https://github.com/markdown-it/markdown-it/commit/9ce2087562c45d1e5ddd9f76b990f4b3fbe040e5 x_refsource_MISC

Affected products

markdown-it

==< 14.2.0

Matching in nixpkgs

pkgs.python312Packages.markdown-it-py

None

pkgs.python313Packages.markdown-it-py

Markdown parser in Python

nixos-unstable 4.0.0
- nixpkgs-unstable 4.0.0
- nixos-unstable-small 4.0.0
nixos-26.05 4.0.0
- nixos-26.05-small 4.0.0
- nixpkgs-26.05-darwin 4.0.0

pkgs.python314Packages.markdown-it-py

Markdown parser in Python

nixos-unstable 4.0.0
- nixpkgs-unstable 4.0.0
- nixos-unstable-small 4.0.0
nixos-26.05 4.0.0
- nixos-26.05-small 4.0.0
- nixpkgs-26.05-darwin 4.0.0

Dismissed

Permalink CVE-2023-26302

3.3 LOW

CVSS version (CVSS): 3.1
Attack Vector (AV): Local (L)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): None (N)
Availability (A): Low (L)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): Low (L)

updated 1 year, 3 months ago by @LeSuisse Activity log

Created suggestion 1 year, 4 months ago
@LeSuisse dismissed 1 year, 3 months ago

markdown-it-py CLI crash on invalid UTF-8 characters

Denial of service could be caused to the command line interface of markdown-it-py, before v2.2.0, if an attacker was allowed to use invalid UTF-8 characters as input.