VDB
CVE-2026-111758
CVE-2026-111758
PUBLISHED
CVSS 7.5 HIGH
Reported by GitHub_M · Published October 20, 2026
markdown-it is a Markdown parser. From versions 14.1.0 to before 14.3.3, and 15.0.0 to before 15.0.3, a link reference definition whose label or title is never closed is O(n²) with default options. Continuation lines are pulled lazily with str += lineContent in src/rules_block/reference.ts, and the subsequent charCodeAt and slice calls flatten the V8 cons-string, copying everything collected so far; this runs before the rule decides the definition is invalid. No options are required to trigger it. This issue has been patched in versions 14.3.3 and 15.0.3.
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| markdown-it | markdown-it | >= 14.1.0, < 14.3.3, >= 15.0.0, < 15.0.3 |
| wolfi | renovate | 0 |
| chainguard | vitess-22 | 0 |
| chainguard | gitlab-rails-ce-19.3 | 0 |
| chainguard | commercial-gitlab-rails-ee-fips-19.1 | 0 |
| chainguard | supabase | 0 |
| chainguard | kibana-8.19 | 0 |
| npm | markdown-it | |
| chainguard | kibana-9.2 | 0 |
| chainguard | renovate | 0 |
| markdown-it | markdown-it | 14.1.0, 15.0.0 |
| npm | markdown-it | 14.1.0, 15.0.0 |
| chainguard | kibana-9.3 | 0 |
Timeline
- Oct 20, 2026 CVE Published
- Oct 20, 2026 Coalition ESS Score
- Oct 21, 2026 EPSS Score
- Oct 24, 2026 EPSS Score
- Oct 25, 2026 EPSS Score
- Oct 28, 2026 CVE Updated
- Oct 29, 2026 EPSS Score
- Oct 31, 2026 Security Advisory
References
- https://github.com/markdown-it/markdown-it/security/advisories/GHSA-gfr2-rv44-r23c x_refsource_CONFIRM
- https://github.com/markdown-it/markdown-it/commit/48fbc465812c440020c663f040ab22deaf8f1eca x_refsource_MISC
- https://github.com/markdown-it/markdown-it/commit/d99f48839d37af6fd8a2617516c43dab90755503 x_refsource_MISC
- https://github.com/markdown-it/markdown-it/releases/tag/14.3.3 x_refsource_MISC
- https://github.com/markdown-it/markdown-it/releases/tag/15.0.3 x_refsource_MISC
- https://nvd.nist.gov/vuln/detail/CVE-2026-111758 advisory
- https://github.com/advisories/GHSA-gfr2-rv44-r23c advisory