PT-2026-49555 · Npm · Markdown-It

Published 2026-06-15 · Updated 2026-06-15 · CVE-2026-48988

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions markdown-it (affected versions not specified)

Description A quadratic time complexity issue exists in the smartquotes rule when the typographer: true option is enabled. An attacker can provide markdown input containing a large number of consecutive quotation marks, causing the parser to consume excessive CPU resources and leading to a denial of service. This occurs because the replaceAt() function in lib/rules core/smartquotes.mjs modifies the token.content using string slicing and concatenation for every quote character found. Since each slice operation is O(n) and is performed for each of the n quotes, the overall complexity becomes O(n^2).

Recommendations As a temporary workaround, consider disabling the typographer option by setting it to false to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Resource Exhaustion

Weakness Enumeration

CWE-400

CWE-407

Related Identifiers

CVE-2026-48988

GHSA-6V5V-WF23-FMFQ

Affected Products

Markdown-It

References · 4

• https://osv.dev/vulnerability/GHSA-6v5v-wf23-fmfq · Vendor Advisory
• https://github.com/markdown-it/markdown-it · Note
• https://github.com/markdown-it/markdown-it/security/advisories/GHSA-6v5v-wf23-fmfq · Note
• https://twitter.com/dailycve/status/2066667873917915565 · Twitter Post