PT-2026-7818 · Unknown · Markdown-It

Ltduc147

·

Published

2026-02-12

·

Updated

2026-05-18

·

CVE-2026-2327

CVSS v3.1

7.5

High

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Name of the Vulnerable Software and Affected Versions markdown-it versions 13.0.0 through 14.1.0
Description The software is susceptible to a Regular Expression Denial of Service (ReDoS) condition. This occurs due to the use of the regular expression /*+$/ within the linkify function. An attacker can provide a specially crafted input consisting of a long sequence of * characters followed by a non-matching character. This input causes excessive backtracking in the regular expression engine, potentially leading to a denial-of-service condition. The linkify function is the component responsible for processing the input. The * character is used as part of the vulnerable regular expression.
Recommendations Update to a version later than 14.1.0.

Exploit

Fix

DoS

Weakness Enumeration

CWE-1333

Related Identifiers

CLEANSTART-2026-CE10526
CLEANSTART-2026-DV49099
CLEANSTART-2026-GS57401
CLEANSTART-2026-NB51079
CLEANSTART-2026-OW14933
CLEANSTART-2026-SW34937
CVE-2026-2327
GHSA-38C4-R59V-3VQW

Affected Products

Markdown-It