Github · Gomarkdown/Markdown · CVE-2026-40890
**Name of the Vulnerable Software and Affected Versions**
github.com/gomarkdown/markdown (affected versions not specified)
**Description**
Processing malformed input containing a < character that is not followed by a > character anywhere in the remaining text using a SmartypantsRenderer can lead to an Out of Bounds read or a panic. This occurs because the `smartLeftAngle()` function performs an out-of-bounds slice operation. If the slice length is lower than its capacity, an extra byte of data is read; if the length equals the capacity, it results in a panic, potentially leading to a Denial of Service on the processing service.
**Recommendations**
Apply the fix provided in commit 759bbc3e32073c3bc4e25969c132fc520eda2778.