{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/cve-2026-40890/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-40890"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":[],"_cs_severities":["medium"],"_cs_tags":["markdown","go","denial-of-service","cve-2026-40890"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThe \u003ccode\u003egithub.com/gomarkdown/markdown\u003c/code\u003e library, a widely used Go package for parsing Markdown and rendering it as HTML, contains a vulnerability (CVE-2026-40890) that can be triggered by processing specially crafted Markdown input. Specifically, if the input contains a \u003ccode\u003e\u0026lt;\u003c/code\u003e character that is not subsequently closed by a \u003ccode\u003e\u0026gt;\u003c/code\u003e character, the SmartypantsRenderer will cause an out-of-bounds read or panic. This issue was introduced in an earlier version of the library and was addressed in commit 759bbc3e32073c3bc4e25969c132fc520eda2778. Exploitation of this vulnerability can lead to a denial-of-service (DoS) condition, affecting applications that rely on this library to process untrusted Markdown content. Defenders should ensure they are running a patched version of the library.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker crafts a malicious Markdown document containing a \u003ccode\u003e\u0026lt;\u003c/code\u003e character without a closing \u003ccode\u003e\u0026gt;\u003c/code\u003e character.\u003c/li\u003e\n\u003cli\u003eA user or automated system submits the malicious Markdown document to an application using the vulnerable \u003ccode\u003egithub.com/gomarkdown/markdown\u003c/code\u003e library.\u003c/li\u003e\n\u003cli\u003eThe application calls the \u003ccode\u003emarkdown.ToHTML\u003c/code\u003e function with the crafted Markdown and uses \u003ccode\u003eSmartypantsRenderer\u003c/code\u003e to render to HTML.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eSmartypantsRenderer\u003c/code\u003e attempts to process the malformed \u003ccode\u003e\u0026lt;\u003c/code\u003e character.\u003c/li\u003e\n\u003cli\u003eDue to the missing \u003ccode\u003e\u0026gt;\u003c/code\u003e, the renderer attempts to read beyond the bounds of the input buffer, triggering an out-of-bounds read.\u003c/li\u003e\n\u003cli\u003eThe out-of-bounds read leads to a panic within the Go application.\u003c/li\u003e\n\u003cli\u003eThe panic crashes the Go application, causing a denial-of-service.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this vulnerability results in a denial-of-service condition. Applications using the vulnerable version of \u003ccode\u003egithub.com/gomarkdown/markdown\u003c/code\u003e may crash when processing attacker-controlled Markdown input. The severity of the impact depends on the role of the affected application; if it is a critical service, the denial of service could have significant consequences. The number of potential victims is proportional to the number of applications using the vulnerable \u003ccode\u003egithub.com/gomarkdown/markdown\u003c/code\u003e library and processing potentially untrusted Markdown content.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate the \u003ccode\u003egithub.com/gomarkdown/markdown\u003c/code\u003e library to a version containing commit 759bbc3e32073c3bc4e25969c132fc520eda2778 or later to remediate the vulnerability.\u003c/li\u003e\n\u003cli\u003eImplement input validation to sanitize Markdown input before processing it with the \u003ccode\u003egithub.com/gomarkdown/markdown\u003c/code\u003e library.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-04-22T12:00:00Z","date_published":"2026-04-22T12:00:00Z","id":"https://feed.craftedsignal.io/briefs/2026-04-22-gomarkdown-oob-read/","summary":"The `github.com/gomarkdown/markdown` Go library is susceptible to an out-of-bounds read or panic when processing malformed input with the SmartypantsRenderer, potentially leading to a denial-of-service condition.","title":"Go-Markdown Library Vulnerable to Out-of-Bounds Read via Malformed Input","url":"https://feed.craftedsignal.io/briefs/2026-04-22-gomarkdown-oob-read/"}],"language":"en","title":"CraftedSignal Threat Feed - Cve-2026-40890","version":"https://jsonfeed.org/version/1.1"}