Go-Markdown Library Vulnerable to Out-of-Bounds Read via Malformed Input

The github.com/gomarkdown/markdown library, a widely used Go package for parsing Markdown and rendering it as HTML, contains a vulnerability (CVE-2026-40890) that can be triggered by processing specially crafted Markdown input. Specifically, if the input contains a < character that is not subsequently closed by a > character, the SmartypantsRenderer will cause an out-of-bounds read or panic. This issue was introduced in an earlier version of the library and was addressed in commit 759bbc3e32073c3bc4e25969c132fc520eda2778. Exploitation of this vulnerability can lead to a denial-of-service (DoS) condition, affecting applications that rely on this library to process untrusted Markdown content. Defenders should ensure they are running a patched version of the library.

Attack Chain

1. An attacker crafts a malicious Markdown document containing a < character without a closing > character.
2. A user or automated system submits the malicious Markdown document to an application using the vulnerable github.com/gomarkdown/markdown library.
3. The application calls the markdown.ToHTML function with the crafted Markdown and uses SmartypantsRenderer to render to HTML.
4. The SmartypantsRenderer attempts to process the malformed < character.
5. Due to the missing >, the renderer attempts to read beyond the bounds of the input buffer, triggering an out-of-bounds read.
6. The out-of-bounds read leads to a panic within the Go application.
7. The panic crashes the Go application, causing a denial-of-service.

Impact

Successful exploitation of this vulnerability results in a denial-of-service condition. Applications using the vulnerable version of github.com/gomarkdown/markdown may crash when processing attacker-controlled Markdown input. The severity of the impact depends on the role of the affected application; if it is a critical service, the denial of service could have significant consequences. The number of potential victims is proportional to the number of applications using the vulnerable github.com/gomarkdown/markdown library and processing potentially untrusted Markdown content.

Recommendation

• Update the github.com/gomarkdown/markdown library to a version containing commit 759bbc3e32073c3bc4e25969c132fc520eda2778 or later to remediate the vulnerability.
• Implement input validation to sanitize Markdown input before processing it with the github.com/gomarkdown/markdown library.