Is CVE-2026-102941 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-102941 being exploited in the wild.

How severe is CVE-2026-102941?

High severity, with a CVSS score of 7.5, published 16 October 2026.

Which products and versions are affected?

github.com/gomarkdown/markdown (Go) < 0.0.0-20260724235538-61af6e1e6971, SEMVER:introduced=0,fixed=0.0.0-20260724235538-61af6e1e6971; Gomarkdown Markdown present since 2022 through HEAD (e08cff8).

How is CVE-2026-102941 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-102941?

Check whether you run github.com/gomarkdown/markdown (Go) or Gomarkdown Markdown at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-102941: gomarkdown markdown IsSafeURL panic on short URLs

Q: Is there a fix for CVE-2026-102941?

Yes. github.com/gomarkdown/markdown (Go): upgrade to 0.0.0-20260724235538-61af6e1e6971 or later. Until then: Disable the html.Safelink hardening flag if it is not critical to your use case, or restrict Markdown rendering to trusted input only. Services that call IsSafeURL directly should validate URL length before passing it to the function. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-102941 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-102941?

Check whether you run github.com/gomarkdown/markdown (Go) or Gomarkdown Markdown at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-102941 · Severity: high · CVSS 7.5 · Published 2026-10-16

gomarkdown is a Markdown-to-HTML parser library used in web services to render user-supplied content. When the Safelink security hardening flag is enabled, empty or very short link destinations (1-2 bytes) cause the parser to crash with a panic, resulting in a denial of service. An attacker can trigger this by submitting a Markdown document with an empty link like `[x]()`, immediately crashing the rendering service.

Technologies: github.com/gomarkdown/markdown (Go). Vendors: Go.

Quick answers

Is CVE-2026-102941 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-102941 being exploited in the wild.
How severe is CVE-2026-102941?: High severity, with a CVSS score of 7.5, published 16 October 2026.
Which products and versions are affected?: github.com/gomarkdown/markdown (Go) < 0.0.0-20260724235538-61af6e1e6971, SEMVER:introduced=0,fixed=0.0.0-20260724235538-61af6e1e6971; Gomarkdown Markdown present since 2022 through HEAD (e08cff8).
Is there a fix for CVE-2026-102941?: Yes. github.com/gomarkdown/markdown (Go): upgrade to 0.0.0-20260724235538-61af6e1e6971 or later. Until then: Disable the html.Safelink hardening flag if it is not critical to your use case, or restrict Markdown rendering to trusted input only. Services that call IsSafeURL directly should validate URL length before passing it to the function. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-102941 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-102941?: Check whether you run github.com/gomarkdown/markdown (Go) or Gomarkdown Markdown at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/gomarkdown/markdown (Go): upgrade to 0.0.0-20260724235538-61af6e1e6971 or later
```
go get github.com/gomarkdown/markdown@v0.0.0-20260724235538-61af6e1e6971
```

Disable the html.Safelink hardening flag if it is not critical to your use case, or restrict Markdown rendering to trusted input only. Services that call IsSafeURL directly should validate URL length before passing it to the function.

Technical details

The IsSafeURL function in parser/parser.go performs a slice operation url[:nPath] before validating that len(url) >= nPath, causing a slice-bounds panic for URLs shorter than the path prefix being tested (0, 1, or 2 bytes). This occurs when the html.Safelink hardening flag is enabled, or when IsSafeURL is called directly on short attacker-controlled input. The vulnerability is reachable end-to-end via markdown.ToHTML() with html.Safelink flag and input like `[x]()`, with no recover() handler to prevent goroutine crash.

Affected products

gomarkdown markdown present since 2022 through HEAD (e08cff8)

Identifiers

CVE-2026-102941
GHSA-cv23-7vc5-jfh7

Timeline

2026-10-16: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.