Read the docs
TI-2025-05894 Aliases CVE-2025-6493GHSA-pff4-9qxc-79mq

CodeMirror Markdown Mode markdown.js redos

Priority HIGH 70CWE-1333Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-1333.

Summary

A weakness has been identified in CodeMirror up to 5.65.20. Affected is an unknown function of the file mode/markdown/markdown.js of the component Markdown Mode. This manipulation causes inefficient regular expression complexity. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be exploited. Upgrading to version 6.0 is able to address this issue. You should upgrade the affected component. Not all code samples mentioned in the GitHub issue can be found. The repository mentions, that "CodeMirror 6 exists, and is [...] much more actively maintained."

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00535 45th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed CodeMirror: 6.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—CodeMirror5.65.0; 5.65.1; 5.65.2; 5.65.3; 5.65.4; 5.65.5; 5.65.6; 5.65.7; 5.65.8; 5.65.9; 5.65.10; 5.65.11; 5.65.12; 5.65.13; 5.65.14; 5.65.15; 5.65.16; 5.65.17; 5.65.18; 5.65.19; 5.65.206.0Patch availableCNA
  • CodeMirror Vendor— Affected 5.65.0; 5.65.1; 5.65.2; 5.65.3; 5.65.4; 5.65.5; 5.65.6; 5.65.7; 5.65.8; 5.65.9; 5.65.10; 5.65.11; 5.65.12; 5.65.13; 5.65.14; 5.65.15; 5.65.16; 5.65.17; 5.65.18; 5.65.19; 5.65.20 Fixed in 6.0 Patch available CNA

Remediation

  • Fix · CNA CodeMirror Fixed in 6.0

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Not affected: 12 products
  • OpenShift Serverless
  • Red Hat Developer Hub 1
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat Fuse 7
  • Red Hat JBoss Enterprise Application Platform 7
  • Red Hat JBoss Enterprise Application Platform 8
  • Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift Dev Spaces

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-6493
  2. 2026-10-03 Alias added: GHSA-pff4-9qxc-79mq
  3. 2026-10-27 Affected versions changed · Red Hat

References

Exploit 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences