org.webjars.npm:markdown-it 14.3.2

Direct Vulnerabilities

Known vulnerabilities in the org.webjars.npm:markdown-it package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
M Regular Expression Denial of Service (ReDoS) org.webjars.npm:markdown-it is a modern pluggable markdown parser. Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via the inline HTML parsing rule in `src/rules_inline/html_inline.ts`, where the `HTML_TAG_RE` regular expression is applied against untrusted input. An attacker can supply input containing unclosed HTML special constructs (comments, processing instructions, declarations, or CDATA sections) to trigger quadratic backtracking, causing the parser to consume excessive CPU time and crash the process. Note: This is only exploitable when the `html` option is enabled, for example via the `commonmark` preset. The default configuration has HTML disabled and is unaffected. How to fix Regular Expression Denial of Service (ReDoS)? Upgrade `org.webjars.npm:markdown-it` to version 14.3.3, 15.0.3 or higher.	[,14.3.3)[15.0.0,15.0.3)
H Inefficient Algorithmic Complexity org.webjars.npm:markdown-it is a modern pluggable markdown parser. Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity in the `reference` block rule (`src/rules_block/reference.ts`) via parsing of reference labels. An attacker can supply input containing a long reference label, triggering quadratic time complexity during parsing and causing the process to hang. How to fix Inefficient Algorithmic Complexity? Upgrade `org.webjars.npm:markdown-it` to version 15.0.3, 14.3.3 or higher.	[15.0.0,15.0.3)[14.1.0,14.3.3)

Vulnerability

Vulnerable Version

Regular Expression Denial of Service (ReDoS)

org.webjars.npm:markdown-it is a modern pluggable markdown parser.

Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via the inline HTML parsing rule in src/rules_inline/html_inline.ts, where the HTML_TAG_RE regular expression is applied against untrusted input. An attacker can supply input containing unclosed HTML special constructs (comments, processing instructions, declarations, or CDATA sections) to trigger quadratic backtracking, causing the parser to consume excessive CPU time and crash the process.

Note: This is only exploitable when the html option is enabled, for example via the commonmark preset. The default configuration has HTML disabled and is unaffected.

How to fix Regular Expression Denial of Service (ReDoS)?

Upgrade org.webjars.npm:markdown-it to version 14.3.3, 15.0.3 or higher.

[,14.3.3)[15.0.0,15.0.3)

Inefficient Algorithmic Complexity

org.webjars.npm:markdown-it is a modern pluggable markdown parser.

Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity in the reference block rule (src/rules_block/reference.ts) via parsing of reference labels. An attacker can supply input containing a long reference label, triggering quadratic time complexity during parsing and causing the process to hang.

How to fix Inefficient Algorithmic Complexity?

Upgrade org.webjars.npm:markdown-it to version 15.0.3, 14.3.3 or higher.

[15.0.0,15.0.3)[14.1.0,14.3.3)

org.webjars.npm:markdown-it@14.3.2

latest version

latest non vulnerable version

first published

latest version published

licenses detected

package registry

Direct Vulnerabilities

Fix vulnerabilities automatically