Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

6 records

Vendor: Markdown-it Project Clear all filters
TI-2026-01967 CVE-2026-2327 · GHSA-38c4-r59v-3vqw

Regular expression denial of service in markdown-it

Priority HIGH 70

Versions of the package markdown-it from 13.0.0 and before 14.1.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the use of the regex /\*+$/ in the linkify function.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00739 Published 2026-02-12 Fixed in 14.1.1 CWE-1333
TI-2025-07289 CVE-2025-7969 · GHSA-vgm8-mvfh-rj89

Markdown-it 14.1.0 - Cross-site scripting (XSS)

Priority HIGH 70

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in markdown-it allows Cross-Site Scripting (XSS).

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00253 Published 2025-08-21 Fix deferred CWE-79
TI-2015-07933 CVE-2015-10005 · GHSA-j5p7-jf4q-742q

markdown-it html_re.js redos

Priority LOW 35

A vulnerability was found in markdown-it up to 2.x.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01026 Published 2022-12-27 Fixed in 3.0.0 CWE-1333