Is CVE-2026-54888 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-54888 being exploited in the wild.

How severe is CVE-2026-54888?

Informational severity, with a CVSS score of 6.9, published 29 June 2026.

Which products and versions are affected?

Leandrocp Mdex 0.3.0 before 0.12.3; Leandrocp Mdex Native 0.1.0 before 0.2.3.

Is there a fix for CVE-2026-54888?

A patch was published on 2026-06-19: Initial patch commit in mdex_native repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-54888 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-54888?

Check whether you run Leandrocp Mdex or Leandrocp Mdex Native at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54888: leandrocp mdex uncontrolled recursion in Markdown parsing

CVE-2026-54888 · Severity: info · CVSS 6.9 · Published 2026-06-29

A vulnerability in the mdex Markdown processing library can allow an attacker to crash an entire Elixir or Erlang application. By providing a specially crafted Markdown document with deeply nested elements, an attacker can trigger a system-level failure that the application cannot recover from. This results in a complete denial of service for all users and processes running on the affected server node.

Technologies: Leandrocp Mdex, Leandrocp Mdex Native. Vendors: Leandrocp.

Quick answers

Is CVE-2026-54888 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-54888 being exploited in the wild.
How severe is CVE-2026-54888?: Informational severity, with a CVSS score of 6.9, published 29 June 2026.
Which products and versions are affected?: Leandrocp Mdex 0.3.0 before 0.12.3; Leandrocp Mdex Native 0.1.0 before 0.2.3.
Is there a fix for CVE-2026-54888?: A patch was published on 2026-06-19: Initial patch commit in mdex_native repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54888 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-54888?: Check whether you run Leandrocp Mdex or Leandrocp Mdex Native at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an uncontrolled recursion (CWE-674) located in the Rust NIF (Native Implemented Function) component of the mdex library. Specifically, the functions `ex_document_to_comrak_ast` and `comrak_ast_to_ex_document` in `document.rs` lack nesting depth limits when converting between Elixir structs and Comrak's internal AST. An attacker can provide a Markdown document with thousands of nested block quotes to exhaust the native C stack, triggering an uncatchable SIGSEGV. Because this occurs within a NIF, it bypasses the Erlang runtime's fault tolerance and terminates the entire BEAM process. The issue was fixed by replacing recursive logic with an iterative, stack-based conversion in mdex 0.12.3 and mdex_native 0.2.3.

Affected products

leandrocp mdex 0.3.0 before 0.12.3
leandrocp mdex_native 0.1.0 before 0.2.3

Timeline

2026-06-19: patched: Initial patch commit in mdex_native repository
2026-06-29: advisory: CVE published and NVD record created

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.