CVE-2026-111766Low· 3.7▾ Sunlitmarkdown-it is a Markdown parser. Prior to 14.3.3 and 15.0.3, when the html option or commonmark preset is enabled and the constructs occur inside a paragraph, attacker-controlled Markdown containing repeated unterminated inline HTML com…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 20.4 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Oct 20.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.4%
Last analysed / modified upstream
0.4% → 0.4%
markdown-it is a Markdown parser. Prior to 14.3.3 and 15.0.3, when the html option or commonmark preset is enabled and the constructs occur inside a paragraph, attacker-controlled Markdown containing repeated unterminated inline HTML comments, processing instructions, declarations, or CDATA sections reaches src/rules_inline/html_inline.ts. Its HTML_TAG_RE match searches the remaining suffix for the appropriate terminator; when no terminator is present, parsing advances to the next opener and repeats the match over overlapping input, causing quadratic processing and denial of service through event-loop blocking or an unresponsive browser main thread. HTML blocks and the default HTML-disabled configuration are not affected by these payloads. This issue is fixed in versions 14.3.3 and 15.0.3.
markdown-it >= 15.0.0, < 15.0.3markdown-it < 14.3.3Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
markdown-it < 14.3.3markdown-it >= 15.0.0, < 15.0.3Patched in:
markdown-it 14.3.3markdown-it 15.0.3Source: https://github.com/advisories/GHSA-vfgh-jcmw-g37q
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-111759High· 7.5markdown-it: Quadratic complexity in smartquotes with unmatched closing quotes
CVE-2026-90776High· 7.5Nodemailer versions 9.1.0 through 10.0.4 contain a quadratic time complexity vulnerability in the addressparser component when parsing email addresses with RFC 5322 comments
GHSA-253c-mchw-3w2rMediummarkdown-it linkify: true has two quadratic paths, so a few hundred KB of markdown blocks the event loop for tens of seconds
CVE-2026-83614High· 7.5xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module
CVE-2026-13149High· 7.5brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity (CVE-2026-13149)
CVE-2026-48988Medium· 5.3markdown-it: Quadratic complexity DoS in smartquotes rule via replaceAt string operations