markdown-it: Quadratic complexity DoS in smartquotes rule via replaceAt string operations

Description

A quadratic time complexity vulnerability exists in markdown-it’s smartquotes rule (enabled via the typographer: true option). An attacker can craft a markdown input consisting of consecutive quotation marks that causes the parser to consume excessive CPU time, leading to denial of service.

Recommendation

Update the markdown-it package to the latest compatible version. Followings are version details:

• Affected version(s): <= 14.1.1
• Patched version(s): 14.2.0

References

• GHSA-6v5v-wf23-fmfq
• CVE-2026-48988
• CWE-400
• CWE-407
• CAPEC-310
• OWASP 2021-A6

Related Issues

• linkify-it: Quadratic-complexity DoS via the `mailto:` validator scan-loop on attacker text - CVE-2026-59887
• [Eclipse Theia] Data Exfiltration via Markdown Image Rendering in AI Chat - @theia/ai-core - CVE-2026-22551
• [Eclipse Theia] Data Exfiltration via Markdown Image Rendering in AI Chat - @theia/ai-code-completion - CVE-2026-22551
• DbGate has cross site scripting via the SVG Icon String Handler component - CVE-2026-6216

You might also like:

CSRF, XXE, and 12 Other Security Acronyms Explained

10 Secure Coding Best Practices to Follow in Every Project

Update Cheat Sheet for Developers

Tags:

npm

markdown-it