VDB
DEBIAN-CVE-2025-9670
DEBIAN-CVE-2025-9670
PUBLISHED
CVSS 5.5 MEDIUM
A security flaw has been discovered in mixmark-io turndown up to 7.2.1. This affects an unknown function of the file src/commonmark-rules.js. Performing manipulation results in inefficient regular expression complexity. It is possible to initiate the attack remotely. The exploit has been released to the public and may be exploited.
Risk Scores
CVSS 4.0
5.5
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Debian:14 | node-turndown | 0, 7.1.1-3, 0 |
| Debian:12 | node-turndown | 0, 7.1.1-3, 7.2.2+~2.2.0~git20240406-1 |
| Debian:13 | node-turndown | 7.1.1-3, 7.2.2+~2.2.0~git20240406-1, 7.2.2+~2.2.0~git20240406-2 |
Timeline
- Aug 29, 2025 CVE Published
- Apr 28, 2026 CVE Updated