Executive brief
markdown-it is a widely used library for converting Markdown text into HTML. A flaw in its typography feature allows an attacker to send a specially crafted document that causes the system to consume excessive CPU power. This can lead to a denial-of-service (DoS) condition, making the application slow or completely unresponsive for legitimate users.
Technical details
A denial-of-service vulnerability exists in markdown-it versions 14.1.1 and below due to uncontrolled resource consumption in the smartquotes rule. When the 'typographer' option is enabled, the parser uses a replaceAt() helper function that performs string slicing and concatenation (an O(n) operation) for every quote character found. In inputs with a high density of quotation marks, this results in quadratic (O(n^2)) time complexity. A remote, unauthenticated attacker can exploit this by submitting a markdown payload with many consecutive quotes, leading to CPU exhaustion and service degradation. The issue is fixed in version 14.2.0 by optimizing how string replacements are handled.
Affected products
- markdown-it markdown-it <= 14.1.1
Timeline
- 2026-05-23: advisory: GitHub Security Advisory published
- 2026-06-17: disclosed: CVE-2026-48988 published to NVD
- 2026-06-17: patched: Fixed in version 14.2.0