https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 17:17:33 +0000 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0933 certfr-2026-avi-0933 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0933 https://cve.radiocsirt.org/vuln/euvd-2026-328613 EUVD-2026-328613 https://cve.radiocsirt.org/vuln/euvd-2026-328613 https://cve.radiocsirt.org/vuln/fkie_cve-2026-48988 <p>markdown-it is a Markdown parser. Versions 14.1.1 and below contain a denial-of-service vulnerability when typographer: true is enabled, due to quadratic (O(n^2)) processing in the smartquotes rule. The issue stems from repeatedly modifying strings with replaceAt(), which performs O(n) slicing and concatenation per quote character. This can cause excessive CPU consumption when parsing quote-heavy, user-supplied markdown and may let attackers degrade or disrupt service availability. Although typographer is disabled by default, many production apps enable it for smart typography, making the issue relevant. This issue has been fixed in version 14.2.0.</p> <p>markdown-it is a Markdown parser. Versions 14.1.1 and below contain a denial-of-service vulnerability when typographer: true is enabled, due to quadratic (O(n^2)) processing in the smartquotes rule. The issue stems from repeatedly modifying strings with replaceAt(), which performs O(n) slicing and concatenation per quote character. This can cause excessive CPU consumption when parsing quote-heavy, user-supplied markdown and may let attackers degrade or disrupt service availability. Although typographer is disabled by default, many production apps enable it for smart typography, making the issue relevant. This issue has been fixed in version 14.2.0.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-48988 https://cve.radiocsirt.org/vuln/ghsa-6v5v-wf23-fmfq <p><strong>Affected:</strong> npm: markdown-it</p> <p>### Summary</p> <p>A quadratic time complexity vulnerability exists in markdown-it&#39;s smartquotes rule (enabled via the `typographer: true` option). An attacker can craft a markdown input consisting of consecutive quotation marks that causes the parser to consume excessive CPU time, leading to denial of service.</p> <p>### Details</p> <p>The vulnerability is in the `replaceAt()` helper function used by the smartquotes rule in `lib/rules_core/smartquotes.mjs`:</p> <p>```javascript function replaceAt (str, index, ch) { return str.slice(0, index) + ch + str.slice(index + 1) } ```</p> <p>When markdown-it processes a text token containing many quotation marks (either `&#34;` or `&#39;`) with `typographer: true`, the smartquotes rule iterates through each quote character and calls `replaceAt()` to substitute it with a typographic (curly) quote. Each call to `replaceAt()` creates three new string slices and concatenates them, which is an O(n) operation where n is the length of the string.</p> <p>Since this is called once per quote character in the token, and there are n quote characters, the total time complexity becomes O(n^2).</p> <p>The root cause is that the smartquotes rule modifies `token.content` in place using string slicing rather than building the result incrementally. The `process_inlines()` function (line 14) processes each quote in the text token, and for matching quote pairs, calls `replaceAt()` on both the opening and closing token&#39;s content (lines 151-152). When the entire input is a single text token of quote cha…</p> <p><strong>Affected:</strong> npm: markdown-it</p> <p>### Summary</p> <p>A quadratic time complexity vulnerability exists in markdown-it&#39;s smartquotes rule (enabled via the `typographer: true` option). An attacker can craft a markdown input consisting of consecutive quotation marks that causes the parser to consume excessive CPU time, leading to denial of service.</p> <p>### Details</p> <p>The vulnerability is in the `replaceAt()` helper function used by the smartquotes rule in `lib/rules_core/smartquotes.mjs`:</p> <p>```javascript function replaceAt (str, index, ch) { return str.slice(0, index) + ch + str.slice(index + 1) } ```</p> <p>When markdown-it processes a text token containing many quotation marks (either `&#34;` or `&#39;`) with `typographer: true`, the smartquotes rule iterates through each quote character and calls `replaceAt()` to substitute it with a typographic (curly) quote. Each call to `replaceAt()` creates three new string slices and concatenates them, which is an O(n) operation where n is the length of the string.</p> <p>Since this is called once per quote character in the token, and there are n quote characters, the total time complexity becomes O(n^2).</p> <p>The root cause is that the smartquotes rule modifies `token.content` in place using string slicing rather than building the result incrementally. The `process_inlines()` function (line 14) processes each quote in the text token, and for matching quote pairs, calls `replaceAt()` on both the opening and closing token&#39;s content (lines 151-152). When the entire input is a single text token of quote cha…</p> https://cve.radiocsirt.org/vuln/ghsa-6v5v-wf23-fmfq https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-48988 <p><strong>Affected:</strong> Ubuntu:22.04:LTS: node-markdown-it, Ubuntu:24.04:LTS: node-markdown-it, Ubuntu:25.10: node-markdown-it, Ubuntu:26.04:LTS: node-markdown-it</p> <p>markdown-it is a Markdown parser. Versions 14.1.1 and below contain a denial-of-service vulnerability when typographer: true is enabled, due to quadratic (O(n^2)) processing in the smartquotes rule. The issue stems from repeatedly modifying strings with replaceAt(), which performs O(n) slicing and concatenation per quote character. This can cause excessive CPU consumption when parsing quote-heavy, user-supplied markdown and may let attackers degrade or disrupt service availability. Although typographer is disabled by default, many production apps enable it for smart typography, making the issue relevant. This issue has been fixed in version 14.2.0.</p> <p><strong>Affected:</strong> Ubuntu:22.04:LTS: node-markdown-it, Ubuntu:24.04:LTS: node-markdown-it, Ubuntu:25.10: node-markdown-it, Ubuntu:26.04:LTS: node-markdown-it</p> <p>markdown-it is a Markdown parser. Versions 14.1.1 and below contain a denial-of-service vulnerability when typographer: true is enabled, due to quadratic (O(n^2)) processing in the smartquotes rule. The issue stems from repeatedly modifying strings with replaceAt(), which performs O(n) slicing and concatenation per quote character. This can cause excessive CPU consumption when parsing quote-heavy, user-supplied markdown and may let attackers degrade or disrupt service availability. Although typographer is disabled by default, many production apps enable it for smart typography, making the issue relevant. This issue has been fixed in version 14.2.0.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-48988