PT-2020-21582 · Markdown It · Markdown-It-Toc-And-Anchor

Published 2020-09-01 · Updated 2020-09-01

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions markdown-it-toc-and-anchor versions (affected versions not specified)

Description The issue allows for a Denial of Service. It occurs when parsing markdown that contains **text**+ @[toc], causing the application to enter an infinite loop.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

GHSA-X6M6-5HRF-FH6R

Affected Products

Markdown-It-Toc-And-Anchor

References · 4

• https://osv.dev/vulnerability/GHSA-x6m6-5hrf-fh6r · Vendor Advisory
• https://github.com/medfreeman/markdown-it-toc-and-anchor · Note
• https://npmjs.com/advisories/749 · Note
• https://snyk.io/vuln/SNYK-JS-MARKDOWNITTOCANDANCHOR-73500 · Note