TI-2026-36071 CVE-2026-48801 · GHSA-22p9-wv53-3rq4
linkify-it: Quadratic algorithmic complexity in LinkifyIt#match scan loop
Priority HIGH 77
linkify-it is a links recognition library with full Unicode support.
markdown-it
Records8All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high4CVSS 7.0–8.9
Exploited now
markdown-it records in CISA KEVNo markdown-it vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
8 records
TI-2026-78161 CVE-2026-111758 · GHSA-gfr2-rv44-r23c
Quadratic-time parsing in markdown-it link reference definitions
Priority HIGH 72
markdown-it is a Markdown parser.
TI-2026-76535 CVE-2026-111759 · GHSA-r7fv-28h4-cvq7
Quadratic time in markdown-it smartquotes causes denial of service
Priority HIGH 72
markdown-it is a Markdown parser.
TI-2026-42701 CVE-2026-59887 · GHSA-v245-v573-v5vm
linkify-it: Quadratic-complexity DoS via the `mailto:` validator scan-loop on attacker text
Priority HIGH 72
linkify-it is a links recognition library with full Unicode support.
TI-2025-07289 CVE-2025-7969 · GHSA-vgm8-mvfh-rj89
Markdown-it 14.1.0 - Cross-site scripting (XSS)
Priority HIGH 70
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in markdown-it allows Cross-Site Scripting (XSS).
TI-2026-36244 CVE-2026-48988 · GHSA-6v5v-wf23-fmfq
markdown-it: Quadratic complexity DoS in smartquotes rule via replaceAt string operations
Priority MEDIUM 63
markdown-it is a Markdown parser.
TI-2022-06047 CVE-2022-21670 · GHSA-6vfc-qv3f-vr6c
Uncontrolled Resource Consumption in markdown-it
Priority MEDIUM 63
markdown-it is a Markdown parser.
TI-2026-76568 CVE-2026-111766 · GHSA-vfgh-jcmw-g37q
Quadratic-time denial of service in markdown-it inline HTML parsing
Priority LOW 18
markdown-it is a Markdown parser.