What’s Vulnerable › Products

markdown-it vulnerabilities

9 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 6 published in the last 12 months.

Check whether your markdown-it version is affected

Latest markdown-it vulnerabilities

• CVE-2026-111758 — markdown-it: Quadratic-time rendering of a single multi-line link reference definition with default options (regression since 14.0) (CVSS 7.5)
• CVE-2026-111766 — markdown-it: Quadratic-time denial of service in inline HTML parsing with html enabled (CVSS 3.7)
• CVE-2026-111759 — markdown-it: Quadratic complexity in smartquotes with unmatched closing quotes (CVSS 7.5)
• CVE-2026-48988 — markdown-it: Quadratic complexity DoS in smartquotes rule via replaceAt string operations (CVSS 5.3)
• CVE-2026-2327 — (CVSS 7.5)
• CVE-2025-7969 — Markdown-it 14.1.0 - Cross-site scripting (XSS) (CVSS 6.1)
• CVE-2015-10005 — markdown-it html_re.js redos (CVSS 7.5)
• CVE-2022-21670 — Uncontrolled Resource Consumption in markdown-it (CVSS 5.3)
• CVE-2015-3295 — (CVSS 5.3)