Skip to content
Threat Feed
Subscribe

Tag

Markdown

5 briefs RSS
medium advisory

Mistune Markdown Parser Vulnerability CVE-2026-59930 Allows HTML ID Collision

A vulnerability, CVE-2026-59930, in the Mistune markdown parser's TableOfContents directive creates predictable HTML heading IDs, enabling an attacker to inject content with colliding IDs for client-side content manipulation.

Mistune vulnerability markdown client-side cve
1c
medium advisory

Mistune Markdown Parser Vulnerable to CPU Exhaustion DoS (CVE-2026-49851)

The Mistune Python Markdown parser is vulnerable to a CPU exhaustion Denial of Service (DoS) attack, identified as CVE-2026-49851, due to a superlinear (O(n²)) parsing behavior in the `parse_link_text` function when processing specially crafted input containing repeated square brackets, allowing an attacker to significantly degrade application performance with a small payload.

mistune denial-of-service python library vulnerability markdown
1t 1c
high advisory

Go Markdown Library Out-of-Bounds Read Vulnerability

A vulnerability in the go-markdown library exists where processing a malformed input containing a '<' character that is not followed by a '>' character with a SmartypantsRenderer can lead to an out-of-bounds read or a panic, causing a denial of service.

markdown denial-of-service go out-of-bounds read
2r 1t
high advisory

JustHTML XSS Vulnerability via Code Fence Breakout

JustHTML versions 1.12.0 and earlier are vulnerable to cross-site scripting (XSS) by manipulating the contents of a <pre> element to inject HTML code outside of the intended code block, potentially leading to arbitrary JavaScript execution.

JustHTML xss markdown
2r 1t
high advisory

Potential Notepad Markdown RCE Exploitation (CVE-2026-20841)

A Windows Notepad markdown parsing vulnerability (CVE-2026-20841) can lead to arbitrary code execution, detected by identifying unexpected child processes spawned by Notepad when opening a markdown file.

Notepad markdown rce cve-2026-20841
2r 1t