CVE-2024-1899: Showdown vulnerable to Regular Expression Denial of Service (ReDoS) in link/anchor parsing

CVE-2024-1899 · Severity: medium · CVSS 5.3 · Published 2024-02-26

Showdown is a JavaScript library that converts Markdown to HTML and vice versa, commonly used in web applications and content management systems. A regular expression denial of service (ReDoS) vulnerability in its link/anchor parsing allows an attacker to craft malicious input that causes the library to consume excessive CPU resources, potentially freezing or crashing applications that process user-supplied Markdown.

Technologies: showdown (npm). Vendors: npm.

Quick answers

Is CVE-2024-1899 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2024-1899 being exploited in the wild.
How severe is CVE-2024-1899?
Medium severity, with a CVSS score of 5.3, published 26 February 2024.
Which products and versions are affected?
showdown (npm) <= 2.1.0, SEMVER:introduced=0,last_affected=2.1.0.
Is there a fix for CVE-2024-1899?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2024-1899 attacked?
It is attacked over the network.
Am I affected by CVE-2024-1899?
Check whether you run showdown (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in the anchors subparser component of Showdown, which uses a nested regular expression to parse Markdown links. This regex pattern is susceptible to catastrophic backtracking when processing specially crafted input, leading to denial of service conditions. The attack is network-reachable and requires no authentication or user interaction beyond supplying malicious Markdown content; an attacker can send a maliciously formatted string to any application using Showdown to trigger the ReDoS. The vulnerable code affects all versions up to and including 2.1.0. A patch addressing this issue is expected to be available in future releases.

Affected products

  • Showdown Showdown <=2.1.0

Identifiers

  • CVE-2024-1899
  • GHSA-rmmh-p597-ppvv

Timeline

  • 2024-02-26: disclosed: GHSA-rmmh-p597-ppvv published
  • 2024-02-26: other: CVE-2024-1899 assigned

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.