Read the docs

Markdown-it Project

Records6All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high1CVSS 7.0–8.9

Exploited now

Markdown-it Project records in CISA KEV

No Markdown-it Project vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Markdown-it 6 records HIGH

Records

6 records in Markdown-it · all components

TI-2026-01967 CVE-2026-2327 · GHSA-38c4-r59v-3vqw

Regular expression denial of service in markdown-it

Priority HIGH 70

Versions of the package markdown-it from 13.0.0 and before 14.1.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the use of the regex /\*+$/ in the linkify function.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00739 Published 2026-02-12 Fixed in 14.1.1 CWE-1333
TI-2025-07289 CVE-2025-7969 · GHSA-vgm8-mvfh-rj89

Markdown-it 14.1.0 - Cross-site scripting (XSS)

Priority HIGH 70

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in markdown-it allows Cross-Site Scripting (XSS).

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00253 Published 2025-08-21 Fix deferred CWE-79
TI-2015-07933 CVE-2015-10005 · GHSA-j5p7-jf4q-742q

markdown-it html_re.js redos

Priority LOW 35

A vulnerability was found in markdown-it up to 2.x.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01026 Published 2022-12-27 Fixed in 3.0.0 CWE-1333
Open these records in search →