Executive brief
markdown-it is a popular JavaScript library for parsing and rendering Markdown to HTML, widely used in web applications and content management systems. An inefficient regular expression in the library's HTML parsing code can cause excessive CPU consumption when processing specially crafted input, potentially leading to denial-of-service conditions where the application becomes unresponsive.
Technical details
The vulnerability is a ReDoS (Regular Expression Denial of Service) issue in the HTML regex patterns located in lib/common/html_re.js, specifically affecting the CDATA handling regex. The flaw involves an inefficient regular expression (CWE-1333) that can exhibit catastrophic backtracking when processing malicious input. An unauthenticated attacker can send specially crafted Markdown input to an application using vulnerable versions of markdown-it, causing the regex engine to consume excessive CPU resources and hang the application. The vulnerability affects all versions prior to 3.0.0, which introduced a regex fix (commit 89c8620). Patching involves upgrading to version 3.0.0 or later.
Affected products
- markdown-it markdown-it < 3.0.0
Timeline
- 2022-12-27: disclosed
- 2022-12-27: patched: Fixed in version 3.0.0