Executive brief
Showdown is a JavaScript library that converts Markdown to HTML and vice versa, commonly used in web applications and content management systems. A regular expression denial of service (ReDoS) vulnerability in its link/anchor parsing allows an attacker to craft malicious input that causes the library to consume excessive CPU resources, potentially freezing or crashing applications that process user-supplied Markdown.
Technical details
The vulnerability exists in the anchors subparser component of Showdown, which uses a nested regular expression to parse Markdown links. This regex pattern is susceptible to catastrophic backtracking when processing specially crafted input, leading to denial of service conditions. The attack is network-reachable and requires no authentication or user interaction beyond supplying malicious Markdown content; an attacker can send a maliciously formatted string to any application using Showdown to trigger the ReDoS. The vulnerable code affects all versions up to and including 2.1.0. A patch addressing this issue is expected to be available in future releases.
Affected products
- Showdown Showdown <=2.1.0
Timeline
- 2024-02-26: disclosed: GHSA-rmmh-p597-ppvv published
- 2024-02-26: other: CVE-2024-1899 assigned