PT-2026-33236 · Github · Gomarkdown/Markdown

Julesdt · Published 2026-04-14 · Updated 2026-05-18 · CVE-2026-40890

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions github.com/gomarkdown/markdown (affected versions not specified)

Description Processing malformed input containing a < character that is not followed by a > character anywhere in the remaining text using a SmartypantsRenderer can lead to an Out of Bounds read or a panic. This occurs because the smartLeftAngle() function performs an out-of-bounds slice operation. If the slice length is lower than its capacity, an extra byte of data is read; if the length equals the capacity, it results in a panic, potentially leading to a Denial of Service on the processing service.

Recommendations Apply the fix provided in commit 759bbc3e32073c3bc4e25969c132fc520eda2778.

Exploit

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CLEANSTART-2026-FO93349

CVE-2026-40890

GHSA-77FJ-VX54-GVH7

Affected Products

Gomarkdown/Markdown

References · 23

• 🔥 https://github.com/gomarkdown/markdown/security/advisories/GHSA-77fj-vx54-gvh7 · Exploit
• https://github.com/gomarkdown/markdown/commit/759bbc3e32073c3bc4e25969c132fc520eda2778 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-33186 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-68121 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-40890 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-61732 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-40890 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-40890 · Security Note
• https://osv.dev/vulnerability/CLEANSTART-2026-FO93349 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-40890 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-40890 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-77fj-vx54-gvh7 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-40890 · Vendor Advisory
• https://github.com/gomarkdown/markdown · Note
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-FO93349.json · Note