Skip to content
CVE Ledger
  • Newest CVEsPage
  • Recently added to KEVPage
  • Rising exploitation (EPSS)Page
  • Weekly digestPage
  • StatisticsPage
  • WatchlistPage
  • API docsPage
  • MCP serverPage
  • AboutPage
  • Data sourcesPage
  • Data statusPage
  • ChangelogPage
  • How it's builtPage
  • Support the projectPage

14 results

markdown-it vulnerabilities

8 published CVEs name markdown-it among the affected products.

Newest CVEs

  • CVE-2026-111758

    markdown-it: Quadratic-time rendering of a single multi-line link reference definition with default options (regression since 14.0)

    markdown-it · markdown-it

    High7.5
  • CVE-2026-111766

    markdown-it: Quadratic-time denial of service in inline HTML parsing with html enabled

    markdown-it · markdown-it

    Low3.7
  • CVE-2026-111759

    markdown-it: Quadratic complexity in smartquotes with unmatched closing quotes

    markdown-it · markdown-it

    High7.5
  • CVE-2026-48801

    linkify-it: Quadratic algorithmic complexity in LinkifyIt#match scan loop

    markdown-it · linkify-it

    High8.7
  • CVE-2026-59887

    linkify-it: Quadratic-complexity DoS via the `mailto:` validator scan-loop on attacker text

    markdown-it · linkify-it

    High7.5
  • CVE-2026-48988

    markdown-it: Quadratic complexity DoS in smartquotes rule via replaceAt string operations

    markdown-it · markdown-it

    Medium5.3
  • CVE-2025-7969

    Markdown-it 14.1.0 - Cross-site scripting (XSS)

    markdown-it · markdown-it

    Medium6.9
  • CVE-2022-21670

    Uncontrolled Resource Consumption in markdown-it

    markdown-it · markdown-it

    Medium5.3