Executive brief
HedgeDoc is an open-source collaborative platform used for real-time markdown note-taking. A vulnerability in how the application processes note metadata allows an attacker to upload a specially crafted note that triggers a 'YAML bomb,' which exhausts the server's processing power. This results in a persistent denial-of-service, making the platform unavailable to all users and potentially requiring manual database intervention to restore service.
Technical details
HedgeDoc prior to version 1.11.0 used an insecure YAML parser (js-yaml v3 via @hedgedoc/meta-marked) that resolved YAML anchor aliases by default. An attacker with note-creation privileges can submit a compact YAML payload in the note frontmatter that expands into a massive object structure upon parsing. This expansion occurs on every request to the publish (/s/<shortid>) or editor (/<noteId>) views, saturating the single-threaded Node.js event loop for several minutes per request. Because the malicious payload is stored in the database, the DoS effect persists across application restarts. The issue was resolved in version 1.11.0 by switching to js-yaml v4 and implementing constraints on object depth and string length.
Affected products
- HedgeDoc HedgeDoc < 1.11.0
Timeline
- 2026-06-18: advisory: GitHub Security Advisory published
- 2026-06-18: patched: Fix committed to repository
- 2026-07-13: disclosed: CVE published to NVD