CVE-2022-21670: Uncontrolled Resource Consumption in markdown-it

January 10, 2022 (updated July 24, 2023)

markdown-it is a Markdown parser. special patterns with length greater than thousand characterss could slow down the parser significantly. Users should upgrade to to receive a patch. There are no known workarounds aside from upgrading.

References

github.com/advisories/GHSA-6vfc-qv3f-vr6c
github.com/markdown-it/markdown-it/commit/ffc49ab46b5b751cd2be0aabb146f2ef84986101
github.com/markdown-it/markdown-it/security/advisories/GHSA-6vfc-qv3f-vr6c
nvd.nist.gov/vuln/detail/CVE-2022-21670

Detect and mitigate CVE-2022-21670 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →