markdown-it vulnerabilities
CVEs whose affected-version data names the markdown-it package (npm). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
4 CVEsRSS
CVE-2026-111759High· 7.5PoCmarkdown-it: Quadratic complexity in smartquotes with unmatched closing quotes
markdown-it: Quadratic complexity in smartquotes with unmatched closing quotes
▾ Midnightmarkdown-it · markdown-itEPSS 0.59%via GHSA
CVE-2026-111766Low· 3.7markdown-it: Quadratic-time denial of service in inline HTML parsing with html enabled
markdown-it is a Markdown parser. Prior to 14.3.3 and 15.0.3, when the html option or commonmark preset is enabled and the constructs occur inside a paragraph, attacker-controlled Markdown containing repeated unterminated inline HTML com…
▾ Sunlitmarkdown-it · markdown-itEPSS 0.43%via CVEORG
GHSA-253c-mchw-3w2rMediummarkdown-it linkify: true has two quadratic paths, so a few hundred KB of markdown blocks the event loop for tens of seconds
markdown-it linkify: true has two quadratic paths, so a few hundred KB of markdown blocks the event loop for tens of seconds
▾ Sunlitmarkdown-it · markdown-itvia GHSA
CVE-2026-48988Medium· 5.3markdown-it: Quadratic complexity DoS in smartquotes rule via replaceAt string operations
markdown-it: Quadratic complexity DoS in smartquotes rule via replaceAt string operations
▾ Sunlitmarkdown-it · markdown-itEPSS 0.38%via GHSA