Markdown-it Project

Markdown-it

5 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
7.5

CVE-2026-2327

  • EPSS 0.02%
  • Veröffentlicht 12.02.2026 05:00:07
  • Zuletzt bearbeitet 23.02.2026 14:08:11

Versions of the package markdown-it from 13.0.0 and before 14.1.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the use of the regex /\*+$/ in the linkify function. An attacker can supply a long sequence of * characters follow...

6.1

CVE-2025-7969

Exploit
  • EPSS 0.03%
  • Veröffentlicht 21.08.2025 16:40:05
  • Zuletzt bearbeitet 22.12.2025 19:28:13

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in markdown-it allows Cross-Site Scripting (XSS). This vulnerability is associated with program files lib/renderer.mjs. This issue affects mark...

7.5

CVE-2015-10005

  • EPSS 0.56%
  • Veröffentlicht 27.12.2022 09:15:09
  • Zuletzt bearbeitet 21.11.2024 02:24:09

A vulnerability was found in markdown-it up to 2.x. It has been classified as problematic. Affected is an unknown function of the file lib/common/html_re.js. The manipulation leads to inefficient regular expression complexity. Upgrading to version 3....

5.3

CVE-2022-21670

Exploit
  • EPSS 1.11%
  • Veröffentlicht 10.01.2022 21:15:07
  • Zuletzt bearbeitet 21.11.2024 06:45:11

markdown-it is a Markdown parser. Prior to version 1.3.2, special patterns with length greater than 50 thousand characterss could slow down the parser significantly. Users should upgrade to version 12.3.2 to receive a patch. There are no known workar...

5.3

CVE-2015-3295

  • EPSS 0.58%
  • Veröffentlicht 07.06.2017 21:29:00
  • Zuletzt bearbeitet 20.04.2025 01:37:25

markdown-it before 4.1.0 does not block data: URLs.