Threat database

markdown-it versions 14.1.0 through before 14.3.3 and 15.0.0 through before 15.0.3 contain a regression causing quadratic-time complexity when rendering a single multi-line link reference definition with default options. This results in severe performance degradation, blocking the Node.js event loop for many seconds on large inputs. The issue arises from inefficient string concatenation and parsing logic in the reference rule, leading to an algorithmic complexity denial of service (CWE-407).

markdown-it versions prior to 14.3.3 and from 15.0.0 up to but not including 15.0.3 have a vulnerability where enabling HTML parsing causes quadratic-time denial of service during inline HTML parsing. Specifically, repeated unterminated HTML constructs such as comments, processing instructions, declarations, and CDATA sections cause the parser to perform excessive repeated scans, blocking the Node.js event loop for seconds or tens of seconds. The default configuration disables HTML, but the commonmark preset enables it, making some applications vulnerable. A fix is available.

A denial of service vulnerability exists in markdown-it when the typographer option is enabled. Specially crafted Markdown input with many opening double quotes followed by unmatched closing single quotes causes quadratic processing time in the smartquotes rule. This can lead to significant delays or service disruption when processing untrusted input. The default configuration without typographer enabled is not affected. The issue is fixed in versions 15.0.2 and 14.3.2. Workarounds include disabling the typographer option or disabling the smartquotes rule.

markdown-it versions prior to 15.0.1 and before 14.3.1 have two independent quadratic time complexity paths when the linkify option is enabled. This causes the event loop to be blocked for tens of seconds when processing a few hundred KB of markdown containing many linkifiable tokens, leading to availability degradation. The issue arises from inefficient array rebuilding and repeated regex matching in markdown-it's own code, not in the linkify-it dependency. The vulnerability affects only applications that enable the linkify option, which is off by default.

SAPUI5 (and OpenUI5) packages use outdated 3rd party libraries with known security vulnerabilities. When markdown-it encounters special malformed input, it fails to terminate properly, resulting in an infinite loop. This Denial of Service via infinite loop causes high CPU usage and system unresponsiveness due to a blocked processing thread. This vulnerability has no impact on confidentiality or integrity but has a high impact on system availability.