Homepage

markdown-it@11.0.1

Markdown-it - modern pluggable markdown parser.

  • latest version

    15.0.2

  • latest non vulnerable version

    15.0.2

  • first published

    11 years ago

  • latest version published

    3 days ago

  • licenses detected

  • View markdown-it package health on Snyk  (opens in a new tab)
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the markdown-it package. This does not include vulnerabilities belonging to this package’s dependencies.

    Fix vulnerabilities automatically

    Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

    Fix for free
    VulnerabilityVulnerable Version
    • M
    Inefficient Algorithmic Complexity

    markdown-it is a modern pluggable markdown parser.

    Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the replaceAt() function in the smartquotes rule when processing markdown input with a large number of consecutive quotation marks and the typographer option enabled. An attacker can cause excessive CPU consumption and disrupt service availability by submitting specially crafted markdown content containing many quote characters.

    How to fix Inefficient Algorithmic Complexity?

    Upgrade markdown-it to version 14.2.0 or higher.

    <14.2.0
    • H
    Infinite loop

    markdown-it is a modern pluggable markdown parser.

    Affected versions of this package are vulnerable to Infinite loop in linkify inline rule when using malformed input.

    How to fix Infinite loop?

    Upgrade markdown-it to version 13.0.2 or higher.

    <13.0.2
    • M
    Regular Expression Denial of Service (ReDoS)

    markdown-it is a modern pluggable markdown parser.

    Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via the /s+$/ in line 23 of lib/rules_inline/newline.js. This expression is used to remove trailing whitespaces from a string, however, it also matches non-trailing whitespaces. In the worst-case scenario, the matching process would take computation time proportional to the square of the length of the non-trailing whitespaces. It is possible that a string containing more than tens of thousands characters, as markdown-it handles Markdown, would be passed over the network, resulting in significant computational time.

    How to fix Regular Expression Denial of Service (ReDoS)?

    Upgrade markdown-it to version 12.3.2 or higher.

    <12.3.2
    Go back to all versions of this package