Description
A quadratic time complexity vulnerability exists in markdown-it’s smartquotes rule (enabled via the typographer: true option). An attacker can craft a markdown input consisting of consecutive quotation marks that causes the parser to consume excessive CPU time, leading to denial of service.
Recommendation
Update the markdown-it package to the latest compatible version. Followings are version details:
- Affected version(s): <= 14.1.1
- Patched version(s): 14.2.0
References
Could your website be exposed too?
SmartScanner can check your website for markdown-it: Quadratic complexity DoS in smartquotes rule via replaceAt string operations and gives you actionable findings to investigate.
Start a free scanRelated Issues
- linkify-it: Quadratic-complexity DoS via the `mailto:` validator scan-loop on attacker text - CVE-2026-59887
- [Eclipse Theia] Data Exfiltration via Markdown Image Rendering in AI Chat - @theia/ai-core - CVE-2026-22551
- [Eclipse Theia] Data Exfiltration via Markdown Image Rendering in AI Chat - @theia/ai-code-completion - CVE-2026-22551
- DbGate has cross site scripting via the SVG Icon String Handler component - CVE-2026-6216
You might also like:
See something that needs correcting? Let us knowUpdated June 15, 2026