[ Vendor · 3 CVEs ]
markdown-it
CVEs affecting markdown-it published in the last 30 days, plus any markdown-it CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-111758 | 20 Oct 2026 | CVSS 7.5 | markdown-it: Quadratic-time rendering of a single multi-line link reference definition with default options (regression since 14.0)markdown-it is a Markdown parser. From versions 14.1.0 to before 14.3.3, and 15.0.0 to before 15.0.3, a link reference definition whose label or… | Fix |
| CVE-2026-111766 | 19 Oct 2026 | CVSS 3.7 | markdown-it: Quadratic-time denial of service in inline HTML parsing with html enabledmarkdown-it is a Markdown parser. Prior to 14.3.3 and 15.0.3, when the html option or commonmark preset is enabled and the constructs occur inside a… | Fix |
| CVE-2026-111759 | 19 Oct 2026 | CVSS 7.5 | markdown-it: Quadratic complexity in smartquotes with unmatched closing quotesmarkdown-it is a Markdown parser. Prior to 14.3.2 and 15.0.2, when typographer: true is enabled, specially crafted Markdown can cause quadratic… | Fix |