Suggestions search

Untriaged

Filter by:

With package: python313Packages.markdown-it-py

Found 2 matching suggestions

View:

Compact

Detailed

Permalink CVE-2026-2327

5.3 MEDIUM

CVSS version: 3.1
Attack vector (AV): NETWORK
Attack complexity (AC): LOW
Privileges required (PR): NONE
User interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality impact (C): NONE
Integrity impact (I): NONE
Availability impact (A): LOW

created 2 months ago

Versions of the package markdown-it from 13.0.0 and before 14.1.1 …

Versions of the package markdown-it from 13.0.0 and before 14.1.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the use of the regex /\*+$/ in the linkify function. An attacker can supply a long sequence of * characters followed by a non-matching character, which triggers excessive backtracking and may lead to a denial-of-service condition.

References

Affected products

markdown-it

<14.1.1

Matching in nixpkgs

pkgs.python312Packages.markdown-it-py

Markdown parser in Python

nixos-unstable 3.0.0
nixos-25.11 3.0.0
- nixos-25.11-small 3.0.0
- nixpkgs-25.11-darwin 3.0.0

pkgs.python313Packages.markdown-it-py

Markdown parser in Python

nixos-unstable 3.0.0
- nixpkgs-unstable 4.0.0
- nixos-unstable-small 4.0.0
nixos-25.11 3.0.0
- nixos-25.11-small 3.0.0
- nixpkgs-25.11-darwin 3.0.0

pkgs.python314Packages.markdown-it-py

Markdown parser in Python

nixos-unstable -
- nixpkgs-unstable 4.0.0
- nixos-unstable-small 4.0.0

Package maintainers

@bhipple Benjamin Hipple <bhipple@protonmail.com>

Permalink CVE-2025-7969

created 4 months ago

Markdown-it 14.1.0 - Cross-site scripting (XSS)

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in markdown-it allows Cross-Site Scripting (XSS). This vulnerability is associated with program files lib/renderer.mjs. This issue affects markdown-it: 14.1.0.