Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
18 results
Oct 20, 2026markdown-it is a Markdown parser.CVE-2026-111758 · Other software · markdown-it · reported by GitHubHigh 7.5
markdown-it is a Markdown parser. From versions 14.1.0 to before 14.3.3, and 15.0.0 to before 15.0.3, a link reference definition whose label or title is never closed is O(n²) with default options. Continuation lines are pulled lazily with str += lineContent in src/rules_block/reference.ts, and the subsequent charCodeAt and slice calls flatten the V8 cons-string, copying everything collected so far; this runs before the rule decides the definition is invalid. No options are required to trigger it. This issue has been patched in versions 14.3.3 and 15.0.3.
- Product
- markdown-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2026markdown-it is a Markdown parser.CVE-2026-111766 · Other software · markdown-it · reported by GitHubLow 3.7
markdown-it is a Markdown parser. Prior to 14.3.3 and 15.0.3, when the html option or commonmark preset is enabled and the constructs occur inside a paragraph, attacker-controlled Markdown containing repeated unterminated inline HTML comments, processing instructions, declarations, or CDATA sections reaches src/rules_inline/html_inline.ts. Its HTML_TAG_RE match searches the remaining suffix for the appropriate terminator; when no terminator is present, parsing advances to the next opener and repeats the match over overlapping input, causing quadratic processing and denial of service through event-loop blocking or an unresponsive browser main thread. HTML blocks and the default HTML-disabled configuration are not affected by these payloads. This issue is fixed in versions 14.3.3 and 15.0.3.
- Product
- markdown-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2026markdown-it is a Markdown parser.CVE-2026-111759 · Other software · markdown-it · reported by GitHubHigh 7.5
markdown-it is a Markdown parser. Prior to 14.3.2 and 15.0.2, when typographer: true is enabled, specially crafted Markdown can cause quadratic processing time in the smartquotes rule, potentially leading to denial of service in applications processing untrusted input. Many opening double quotes followed by unmatched closing single quotes cause repeated scans of the entire opener stack. The same issue occurs with the quote types reversed. The default configuration (typographer: false) is not affected, but this option is enabled with high probability. This issue is fixed in versions 14.3.2 and 15.0.2.
- Product
- markdown-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 26, 2026NoteGen before 0.32.0 renders AI chat responses with markdown-it configured with html:true and injects the result into the DOM via dangerouslySetInnerHTML in chCVE-2026-17496 · Other software · codexu · reported by reefs@jfrog.comHigh 8.1
NoteGen before 0.32.0 renders AI chat responses with markdown-it configured with html:true and injects the result into the DOM via dangerouslySetInnerHTML in chat-preview, without HTML sanitization and with CSP set to null. Attacker-controlled content that reaches the model prompt (for example a malicious skill REFERENCE.md that instructs the model to emit HTML) can cause the model response to include executable markup such as an img onerror handler. When the user views the chat response, that markup runs as JavaScript in the privileged Tauri webview, enabling arbitrary script execution in the application context (cross-site scripting).
- Product
- NoteGen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026linkify-it is a links recognition library with full Unicode support.CVE-2026-48801 · Other software · markdown-it · reported by GitHubHigh 8.7
linkify-it is a links recognition library with full Unicode support. Prior to 5.0.1, LinkifyIt.prototype.match, the package's primary public API, has O(N²) algorithmic complexity for inputs containing many fuzzy links or emails because the JavaScript-level scan loop re-slices input and re-runs unanchored regex searches on progressively shorter tails. Any service that synchronously renders untrusted Markdown with linkify:true on a request hot path can inherit a worker-process denial of service triggerable by a tens-of-KB request body. This issue is fixed in version 5.0.1.
- Product
- linkify-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 8, 2026linkify-it is a links recognition library with full Unicode support.CVE-2026-59887 · Other software · markdown-it · reported by GitHubHigh 7.5
linkify-it is a links recognition library with full Unicode support. Prior to 5.0.2, the mailto: schema validator used by .test() and .match() can be invoked at every mailto: occurrence and scan the remaining input through src_email_name in lib/re.mjs, causing O(n^2) CPU consumption on crafted user text. This issue is fixed in version 5.0.2.
- Product
- linkify-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 17, 2026markdown-it is a Markdown parser.CVE-2026-48988 · Other software · markdown-it · reported by GitHubMedium 5.3
markdown-it is a Markdown parser. Versions 14.1.1 and below contain a denial-of-service vulnerability when typographer: true is enabled, due to quadratic (O(n^2)) processing in the smartquotes rule. The issue stems from repeatedly modifying strings with replaceAt(), which performs O(n) slicing and concatenation per quote character. This can cause excessive CPU consumption when parsing quote-heavy, user-supplied markdown and may let attackers degrade or disrupt service availability. Although typographer is disabled by default, many production apps enable it for smart typography, making the issue relevant. This issue has been fixed in version 14.2.0.
- Product
- markdown-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2026Versions of the package markdown-it from 13.0.0 and before 14.1.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the use of the regex /\*CVE-2026-2327 · Other software · Markdown-it Project · reported by report@snyk.ioMedium 5.5
Versions of the package markdown-it from 13.0.0 and before 14.1.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the use of the regex /\*+$/ in the linkify function. An attacker can supply a long sequence of * characters followed by a non-matching character, which triggers excessive backtracking and may lead to a denial-of-service condition.
- Product
- Markdown-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Dec 9, 2025SAPUI5 (and OpenUI5) packages use outdated 3rd party libraries with known security vulnerabilities.CVE-2025-42873 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 5.9
SAPUI5 (and OpenUI5) packages use outdated 3rd party libraries with known security vulnerabilities. When markdown-it encounters special malformed input, it fails to terminate properly, resulting in an infinite loop. This Denial of Service via infinite loop causes high CPU usage and system unresponsiveness due to a blocked processing thread. This vulnerability has no impact on confidentiality or integrity but has a high impact on system availability.
- Product
- SAPUI5 framework (Markdown-it component)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 21, 2025Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in markdown-it allows Cross-Site Scripting (XSS).CVE-2025-7969 · Other software · markdown-it · reported by help@fluidattacks.comMedium 6.9
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in markdown-it allows Cross-Site Scripting (XSS). This vulnerability is associated with program files lib/renderer.mjs. This issue affects markdown-it: 14.1.0. NOTE: the Supplier does not consider this issue to be a vulnerability.
- Product
- markdown-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfluidattacks.comgithub.com
Feb 22, 2023Denial of service could be caused to markdown-it-py, before v2.2.0, if an attacker was allowed to force null assertions with specially crafted input.CVE-2023-26303 · Other software · Executable Books · reported by security@ubuntu.comLow 3.3
Denial of service could be caused to markdown-it-py, before v2.2.0, if an attacker was allowed to force null assertions with specially crafted input.
- Product
- markdown-it-py
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 22, 2023Denial of service could be caused to the command line interface of markdown-it-py, before v2.2.0, if an attacker was allowed to use invalid UTF-8 characters as CVE-2023-26302 · Other software · Executable Books · reported by security@ubuntu.comLow 3.3
Denial of service could be caused to the command line interface of markdown-it-py, before v2.2.0, if an attacker was allowed to use invalid UTF-8 characters as input.
- Product
- markdown-it-py
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 27, 2022A vulnerability was found in markdown-it up to 2.x.CVE-2015-10005 · Other software · Markdown-it Project · reported by VulDBLow 3.5
A vulnerability was found in markdown-it up to 2.x. It has been classified as problematic. Affected is an unknown function of the file lib/common/html_re.js. The manipulation leads to inefficient regular expression complexity. Upgrading to version 3.0.0 is able to address this issue. The name of the patch is 89c8620157d6e38f9872811620d25138fc9d1b0d. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-216852.
- Product
- Markdown-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 25, 2022This affects all versions of package markdown-it-decorate.CVE-2020-28459 · Other software · Markdown-it-decorate Project · reported by report@snyk.ioHigh 7.3
This affects all versions of package markdown-it-decorate. An attacker can add an event handler or use javascript:xxx for the link.
- Product
- Markdown-it-decorate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.snyk.iosecurity.snyk.io
Jul 25, 2022This affects all versions of package markdown-it-toc.CVE-2020-28455 · Other software · Markdown-it-toc Project · reported by report@snyk.ioHigh 7.3
This affects all versions of package markdown-it-toc. The title of the generated toc and the contents of the header are not escaped.
- Product
- Markdown-it-toc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.snyk.iosecurity.snyk.io
Jan 10, 2022markdown-it is a Markdown parser.CVE-2022-21670 · Other software · markdown-it · reported by GitHubMedium 5.3
markdown-it is a Markdown parser. Prior to version 1.3.2, special patterns with length greater than 50 thousand characterss could slow down the parser significantly. Users should upgrade to version 12.3.2 to receive a patch. There are no known workarounds aside from upgrading.
- Product
- markdown-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 16, 2020This affects the package markdown-it-highlightjs before 3.3.1.CVE-2020-7773 · Other software · Markdown-it-highlightjs Project · reported by report@snyk.ioMedium 6.5
This affects the package markdown-it-highlightjs before 3.3.1. It is possible insert malicious JavaScript as a value of lang in the markdown-it-highlightjs Inline code highlighting feature. const markdownItHighlightjs = require("markdown-it-highlightjs"); const md = require('markdown-it'); const reuslt_xss = md() .use(markdownItHighlightjs, { inline: true }) .render('console.log(42){.">js}'); console.log(reuslt_xss);
- Product
- Markdown-it-highlightjs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 7, 2017markdown-it before 4.1.0 does not block data: URLs.CVE-2015-3295 · Other software · Markdown-it Project · reported by MITREMedium 5.3
markdown-it before 4.1.0 does not block data: URLs.
- Product
- Markdown-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comsecurityfocus.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.