{"id":"EUVD-2026-104595","enisaUuid":"078871fa-885f-38d0-921b-3c5d31eb2c05","description":"markdown-it is a Markdown parser. Prior to 14.3.3 and 15.0.3, when the html option or commonmark preset is enabled and the constructs occur inside a paragraph, attacker-controlled Markdown containing repeated unterminated inline HTML comments, processing instructions, declarations, or CDATA sections reaches src/rules_inline/html_inline.ts. Its HTML_TAG_RE match searches the remaining suffix for the appropriate terminator; when no terminator is present, parsing advances to the next opener and repeats the match over overlapping input, causing quadratic processing and denial of service through event-loop blocking or an unresponsive browser main thread. HTML blocks and the default HTML-disabled configuration are not affected by these payloads. This issue is fixed in versions 14.3.3 and 15.0.3.","datePublished":"Oct 19, 2026, 7:47:46 PM","dateUpdated":"Oct 26, 2026, 5:37:11 PM","baseScore":3.7,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","references":"https://github.com/markdown-it/markdown-it/security/advisories/GHSA-vfgh-jcmw-g37q\nhttps://github.com/markdown-it/markdown-it/commit/928bc8c11ded60181c0e7fc5aa954eec582e8e79\nhttps://github.com/markdown-it/markdown-it/commit/d99f48839d37af6fd8a2617516c43dab90755503\nhttps://github.com/markdown-it/markdown-it/releases/tag/14.3.3\nhttps://github.com/markdown-it/markdown-it/releases/tag/15.0.3\n","aliases":"CVE-2026-111766\nGHSA-vfgh-jcmw-g37q\n","assigner":"GitHub_M","epss":0.43,"enisaIdProduct":[{"id":"0f829cb8-6a6f-3a3b-8274-5c9c4722b52d","product":{"name":"markdown-it","vendor":{"name":"markdown-it"}},"product_version":"15.0.0, \u003c 15.0.3"},{"id":"7cc4358a-5bae-3bfa-8a9e-fac92d8c8bc9","product":{"name":"markdown-it","vendor":{"name":"markdown-it"}},"product_version":"\u003c 14.3.3"}],"enisaIdVendor":[{"id":"944b4534-f398-3555-875c-6b8430facccb","vendor":{"name":"markdown-it"}}],"enisaIdVulnerability":[{"id":"4baa09b0-0fb3-3d18-83ff-b4bcd089d86e","vulnerability":{"id":"CVE-2026-111766","description":"markdown-it is a Markdown parser. Prior to 14.3.3 and 15.0.3, when the html option or commonmark preset is enabled and the constructs occur inside a paragraph, attacker-controlled Markdown containing repeated unterminated inline HTML comments, processing instructions, declarations, or CDATA sections reaches src/rules_inline/html_inline.ts. Its HTML_TAG_RE match searches the remaining suffix for the appropriate terminator; when no terminator is present, parsing advances to the next opener and repeats the match over overlapping input, causing quadratic processing and denial of service through event-loop blocking or an unresponsive browser main thread. HTML blocks and the default HTML-disabled configuration are not affected by these payloads. This issue is fixed in versions 14.3.3 and 15.0.3.","datePublished":"Oct 19, 2026, 7:47:46 PM","dateUpdated":"Oct 26, 2026, 5:37:11 PM","status":"PUBLISHED","baseScore":3.7,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","references":"https://github.com/markdown-it/markdown-it/security/advisories/GHSA-vfgh-jcmw-g37q\nhttps://github.com/markdown-it/markdown-it/commit/928bc8c11ded60181c0e7fc5aa954eec582e8e79\nhttps://github.com/markdown-it/markdown-it/commit/d99f48839d37af6fd8a2617516c43dab90755503\nhttps://github.com/markdown-it/markdown-it/releases/tag/14.3.3\nhttps://github.com/markdown-it/markdown-it/releases/tag/15.0.3\n","enisa_id":"EUVD-2026-104595\n","assigner":"GitHub_M","epss":0.43,"dataProcessed":"Oct 29, 2026, 7:14:06 AM","vulnerabilityProduct":[{"id":"29bffa60-b48c-3368-9770-a1cd84c916e2","product":{"name":"markdown-it","vendor":{"name":"markdown-it"}},"product_version":"\u003c 14.3.3"},{"id":"adabaa3f-4845-3268-9eb0-d79f71e5fe01","product":{"name":"markdown-it","vendor":{"name":"markdown-it"}},"product_version":"15.0.0, \u003c 15.0.3"}],"vulnerabilityVendor":[{"id":"1be1eaac-b49b-3d8b-a001-b45d0c2c6ed0","vendor":{"name":"markdown-it"}}]}},{"id":"99045243-1115-3912-a0a9-1948b2a94f2d","vulnerability":{"id":"GHSA-vfgh-jcmw-g37q","description":"markdown-it: Quadratic-time denial of service in inline HTML parsing with html enabled","datePublished":"Oct 20, 2026, 8:08:19 PM","dateUpdated":"Oct 20, 2026, 8:08:20 PM","baseScore":0.0,"references":"https://github.com/markdown-it/markdown-it/security/advisories/GHSA-vfgh-jcmw-g37q\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-111766\nhttps://github.com/markdown-it/markdown-it/commit/928bc8c11ded60181c0e7fc5aa954eec582e8e79\nhttps://github.com/markdown-it/markdown-it/commit/d99f48839d37af6fd8a2617516c43dab90755503\nhttps://github.com/markdown-it/markdown-it\nhttps://github.com/markdown-it/markdown-it/releases/tag/14.3.3\nhttps://github.com/markdown-it/markdown-it/releases/tag/15.0.3\n","enisa_id":"EUVD-2026-104595\n","aliases":"CVE-2026-111766\nGHSA-vfgh-jcmw-g37q\n","epss":0.0,"dataProcessed":"Oct 29, 2026, 7:03:23 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}