A vulnerability in pulldown-cmark versions 0.13.0 up to but not including 0.13.6 allows quadratic parsing time when the ENABLE_WIKILINKS option is enabled. This occurs due to nested image wikilinks causing repeated rescanning of content, leading to a denial-of-service impact. The issue is fixed in version 0.13.6.