GHSA-253c-mchw-3w2rPublished
markdown-it linkify: true has two quadratic paths, so a few hundred KB of markdown blocks the event loop for tens of seconds
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
osv · GHSA-253c-mchw-3w2r
- https://github.com/markdown-it/markdown-it/security/advisories/GHSA-253c-mchw-3w2r
- https://github.com/markdown-it/markdown-it/commit/09fa07118dda4c953f058848f53dae88395618ca
- https://github.com/markdown-it/markdown-it/commit/aaadcfa6d817b3c5f89afb49d97c7b797a6dd4fd
- https://github.com/markdown-it/markdown-it/commit/ad70f6b7cff64bee10e42a774147112480ca0d49
- https://github.com/markdown-it/markdown-it
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.