What’s Vulnerable › Vulnerabilities

CVE-2026-40890: github.com/gomarkdown/markdown: Out-of-bounds Read in SmartypantsRenderer

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-04-21 · updated 2026-10-26
• Weakness: CWE-125

Description

The package `github.com/gomarkdown/markdown` is a Go library for parsing Markdown text and rendering as HTML. Processing a malformed input containing a < character that is not followed by a > character anywhere in the remaining text with a SmartypantsRenderer will lead to Out of Bounds read or a panic. This vulnerability is fixed with commit 759bbc3e32073c3bc4e25969c132fc520eda2778.

Affected products

• gomarkdown markdown: before 2026-04-10 — fixed in 2026-04-10

How to fix

Upgrade to a fixed version: gomarkdown markdown 2026-04-10. Check the vendor advisory for mitigations.

References

• https://github.com/gomarkdown/markdown/commit/759bbc3e32073c3bc4e25969c132fc520eda2778
• https://github.com/gomarkdown/markdown/security/advisories/GHSA-77fj-vx54-gvh7
• https://github.com/gomarkdown/markdown/security/advisories/GHSA-77fj-vx54-gvh7

Get alerted when CVE-2026-40890 or the next vulnerability affects your stack