TI-2026-39661 CVE-2026-54888
Uncontrolled recursion over deeply nested Markdown crashes the BEAM in mdex
Priority MEDIUM 64
Uncontrolled Recursion vulnerability in leandrocp mdex allows denial of service via deeply nested Markdown input.
leandrocp
Records6All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high1CVSS 7.0–8.9
Exploited now
leandrocp records in CISA KEVNo leandrocp vulnerabilities are listed in CISA KEV.
Records
6 records
TI-2026-38511 CVE-2026-53429
Unbounded native memory leak in mdex escaped-tag rendering enables unauthenticated denial of service
Priority MEDIUM 64
Missing Release of Memory after Effective Lifetime vulnerability in leandrocp mdex and mdex_native allows an attacker who controls a rendered document to cause a denial of service through unbounded native memory exhausti…
TI-2026-39662 CVE-2026-54889
Unsanitized URL schemes in MDEx Quill Delta output allow javascript: injection (XSS)
Priority MEDIUM 56
Improper Neutralization of Input During Web Page Generation (XSS) vulnerability in leandrocp mdex allows cross-site scripting via unsanitized URL schemes in Quill Delta output.
Priority LOW 35
Allocation of Resources Without Limits or Throttling vulnerability in leandrocp MDEx allows Excessive Allocation.
Priority LOW 30
Memory Allocation with Excessive Size Value vulnerability in leandrocp mdex allows an unauthenticated attacker to cause a denial of service through unbounded memory allocation.
TI-2026-38509 CVE-2026-53427
Cross-site scripting in MDEx via unescaped highlight_lines_class code-fence attribute
Priority LOW 13
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in leandrocp MDEx allows stored or reflected cross-site scripting via attacker-controlled Markdown.