Skip to content
Threat Feed
Subscribe

Tag

Markdown

7 briefs RSS
high advisory

Out-of-Bounds Read Vulnerability in 92181 markdown Library

An out-of-bounds read vulnerability in the 'lds' function of the 92181 markdown library allows remote attackers to trigger memory access errors via crafted inputs.

markdown vulnerability cve-2026-86303 memory-safety
1c
low advisory

Mistune Denial of Service via Markdown Recursion

Mistune versions 3.3.0 through 3.3.2 are susceptible to a denial of service attack via uncontrolled recursion during the rendering of deeply nested emphasis markers.

mistune denial-of-service markdown python vulnerability
1t 1c
medium advisory

Mistune Markdown Parser Vulnerability CVE-2026-59930 Allows HTML ID Collision

A vulnerability, CVE-2026-59930, in the Mistune markdown parser's TableOfContents directive creates predictable HTML heading IDs, enabling an attacker to inject content with colliding IDs for client-side content manipulation.

Mistune vulnerability markdown client-side cve
1c
medium advisory

Mistune Markdown Parser Vulnerable to CPU Exhaustion DoS (CVE-2026-49851)

The Mistune Python Markdown parser is vulnerable to a CPU exhaustion Denial of Service (DoS) attack, identified as CVE-2026-49851, due to a superlinear (O(n²)) parsing behavior in the `parse_link_text` function when processing specially crafted input containing repeated square brackets, allowing an attacker to significantly degrade application performance with a small payload.

mistune denial-of-service python library vulnerability markdown
1t 1c
high advisory

Go Markdown Library Out-of-Bounds Read Vulnerability

A vulnerability in the go-markdown library exists where processing a malformed input containing a '<' character that is not followed by a '>' character with a SmartypantsRenderer can lead to an out-of-bounds read or a panic, causing a denial of service.

markdown denial-of-service go out-of-bounds read
2r 1t
high advisory

JustHTML XSS Vulnerability via Code Fence Breakout

JustHTML versions 1.12.0 and earlier are vulnerable to cross-site scripting (XSS) by manipulating the contents of a <pre> element to inject HTML code outside of the intended code block, potentially leading to arbitrary JavaScript execution.

JustHTML xss markdown
2r 1t
high advisory

Potential Notepad Markdown RCE Exploitation (CVE-2026-20841)

A Windows Notepad markdown parsing vulnerability (CVE-2026-20841) can lead to arbitrary code execution, detected by identifying unexpected child processes spawned by Notepad when opening a markdown file.

PoC Notepad markdown rce cve-2026-20841
2r 1t 1c updated