Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

Security Advisories: GSA_kwCzR0hTQS1qNXA3LWpmNHEtNzQycc4AAwnP

markdown-it vulnerable to Inefficient Regular Expression Complexity

A vulnerability was found in markdown-it up to 2.x. It has been classified as problematic. Affected is an unknown function of the file lib/common/html_re.js. The manipulation leads to inefficient regular expression complexity. Upgrading to version 3.0.0 is able to address this issue. The name of the patch is 89c8620157d6e38f9872811620d25138fc9d1b0d. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-216852.

Permalink: https://github.com/advisories/GHSA-j5p7-jf4q-742q
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1qNXA3LWpmNHEtNzQycc4AAwnP
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: over 1 year ago
Updated: about 1 year ago


CVSS Score: 7.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Identifiers: GHSA-j5p7-jf4q-742q, CVE-2015-10005
References: Repository: https://github.com/markdown-it/markdown-it
Blast Radius: 39.8

Affected Packages

npm:markdown-it
Dependent packages: 8,475
Dependent repositories: 205,037
Downloads: 27,228,926 last month
Affected Version Ranges: < 3.0.0
Fixed in: 3.0.0
All affected versions: 2.0.0, 2.1.0, 2.1.1, 2.1.2, 2.1.3, 2.2.0, 2.2.1
All unaffected versions: 3.0.0, 3.0.1, 3.0.2, 3.0.3, 3.0.4, 3.0.5, 3.0.6, 3.0.7, 3.1.0, 4.0.0, 4.0.1, 4.0.2, 4.0.3, 4.1.0, 4.1.1, 4.1.2, 4.2.0, 4.2.1, 4.2.2, 4.3.0, 4.3.1, 4.4.0, 5.0.0, 5.0.1, 5.0.2, 5.0.3, 5.1.0, 6.0.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4, 6.0.5, 6.1.0, 6.1.1, 7.0.0, 7.0.1, 8.0.0, 8.0.1, 8.1.0, 8.2.0, 8.2.1, 8.2.2, 8.3.0, 8.3.1, 8.3.2, 8.4.0, 8.4.1, 8.4.2, 9.0.0, 9.0.1, 9.1.0, 10.0.0, 11.0.0, 11.0.1, 12.0.0, 12.0.1, 12.0.2, 12.0.3, 12.0.4, 12.0.5, 12.0.6, 12.1.0, 12.2.0, 12.3.0, 12.3.1, 12.3.2, 13.0.0, 13.0.1, 13.0.2, 14.0.0, 14.1.0