markdown-it has 4 CVEs on record. 3 were published in the last 90 days. The median CVSS is 5.3 (medium). The dominant weakness classes are CWE-400 (4) and CWE-407 (4).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 5.3
- Publish → KEV
- —
- Last 90 days
- 3 prev 1
Weakness classes
Products
- markdown-it 4
Worst active — by depth score
CVE-2026-111759High· 7.5markdown-it: Quadratic complexity in smartquotes with unmatched closing quotes53CVE-2026-48988Medium· 5.3markdown-it: Quadratic complexity DoS in smartquotes rule via replaceAt string operations29GHSA-253c-mchw-3w2rMediummarkdown-it linkify: true has two quadratic paths, so a few hundred KB of markdown blocks the event loop for tens of seconds28CVE-2026-111766Low· 3.7markdown-it: Quadratic-time denial of service in inline HTML parsing with html enabled20
markdown-it vulnerabilities
CVEs affecting markdown-it, newest first. Open any entry for full detail, references, and exploit status.
4 CVEsRSS
CVE-2026-111759High· 7.5PoCmarkdown-it: Quadratic complexity in smartquotes with unmatched closing quotes
markdown-it: Quadratic complexity in smartquotes with unmatched closing quotes
CVE-2026-111766Low· 3.7markdown-it: Quadratic-time denial of service in inline HTML parsing with html enabled
markdown-it is a Markdown parser. Prior to 14.3.3 and 15.0.3, when the html option or commonmark preset is enabled and the constructs occur inside a paragraph, attacker-controlled Markdown containing repeated unterminated inline HTML com…
GHSA-253c-mchw-3w2rMediummarkdown-it linkify: true has two quadratic paths, so a few hundred KB of markdown blocks the event loop for tens of seconds
markdown-it linkify: true has two quadratic paths, so a few hundred KB of markdown blocks the event loop for tens of seconds
CVE-2026-48988Medium· 5.3markdown-it: Quadratic complexity DoS in smartquotes rule via replaceAt string operations
markdown-it: Quadratic complexity DoS in smartquotes rule via replaceAt string operations