# CVE-2026-102941: gomarkdown markdown IsSafeURL panic on short URLs

Source: https://junglewise.ai/threats/cve-2026-102941-gomarkdown-markdown-issafeurl-panics-on-short-urls  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-16. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-102941 · Severity: high · CVSS 7.5 · Published 2026-10-16

gomarkdown is a Markdown-to-HTML parser library used in web services to render user-supplied content. When the Safelink security hardening flag is enabled, empty or very short link destinations (1-2 bytes) cause the parser to crash with a panic, resulting in a denial of service. An attacker can trigger this by submitting a Markdown document with an empty link like `[x]()`, immediately crashing the rendering service.

Technologies: [github.com/gomarkdown/markdown (Go)](https://junglewise.ai/threats/technologies/github-com-gomarkdown-markdown). Vendors: [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-102941 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-102941 being exploited in the wild.

**How severe is CVE-2026-102941?** High severity, with a CVSS score of 7.5, published 16 October 2026.

**Which products and versions are affected?** github.com/gomarkdown/markdown (Go) < 0.0.0-20260724235538-61af6e1e6971, SEMVER:introduced=0,fixed=0.0.0-20260724235538-61af6e1e6971; Gomarkdown Markdown present since 2022 through HEAD (e08cff8).

**Is there a fix for CVE-2026-102941?** Yes. github.com/gomarkdown/markdown (Go): upgrade to 0.0.0-20260724235538-61af6e1e6971 or later. Until then: Disable the html.Safelink hardening flag if it is not critical to your use case, or restrict Markdown rendering to trusted input only. Services that call IsSafeURL directly should validate URL length before passing it to the function. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-102941 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-102941?** Check whether you run github.com/gomarkdown/markdown (Go) or Gomarkdown Markdown at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/gomarkdown/markdown (Go): upgrade to 0.0.0-20260724235538-61af6e1e6971 or later

  ```sh
  go get github.com/gomarkdown/markdown@v0.0.0-20260724235538-61af6e1e6971
  ```


Disable the html.Safelink hardening flag if it is not critical to your use case, or restrict Markdown rendering to trusted input only. Services that call IsSafeURL directly should validate URL length before passing it to the function.

## Technical details

The IsSafeURL function in parser/parser.go performs a slice operation url[:nPath] before validating that len(url) >= nPath, causing a slice-bounds panic for URLs shorter than the path prefix being tested (0, 1, or 2 bytes). This occurs when the html.Safelink hardening flag is enabled, or when IsSafeURL is called directly on short attacker-controlled input. The vulnerability is reachable end-to-end via markdown.ToHTML() with html.Safelink flag and input like `[x]()`, with no recover() handler to prevent goroutine crash.

## Affected products

- gomarkdown markdown present since 2022 through HEAD (e08cff8)

## Identifiers

- CVE-2026-102941
- GHSA-cv23-7vc5-jfh7

## Timeline

- 2026-10-16: disclosed

## Related threats

- [Go Markdown has an Out-of-bounds Read in SmartypantsRenderer](https://junglewise.ai/threats/cve-2026-40890-go-markdown-has-an-out-of-bounds-read-in-smartypantsrenderer)
- [GO-2024-3205 - Infinite loop in github.com/gomarkdown/markdown](https://junglewise.ai/threats/cve-2024-44337-infinite-loop-in-github-com-gomarkdown-markdown)
- [GO-2023-2074 - Parser out-of-bounds read caused by a malformed markdown input in github.com/gomarkdown/markdown](https://junglewise.ai/threats/cve-2023-42821-markdown-vulnerable-to-out-of-bounds-read-while-parsing-citations)