Advisory Database
  • Advisories
  • Dependency Scanning
  1. npm
  2. ›
  3. markdown
  4. ›
  5. GMS-2020-366

GMS-2020-366: Regular Expression Denial of Service in markdown

September 4, 2020

All versions of markdown are vulnerable to Regular Expression Denial of Service (ReDoS). The markdown.toHTML() function has significantly degraded performance when parsing long strings containing underscores. This may lead to Denial of Service if the parser accepts user input. No fix is currently available. Consider using an alternative package until a fix is made available.

References

  • github.com/advisories/GHSA-wx77-rp39-c6vg
  • www.npmjs.com/advisories/1330

Code Behaviors & Features

Detect and mitigate GMS-2020-366 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →

Affected versions

All versions

Solution

Unfortunately, there is no solution available yet.

Source file

npm/markdown/GMS-2020-366.yml

Spotted a mistake? Edit the file on GitLab.

  • Site Repo
  • About GitLab
  • Terms
  • Privacy Statement
  • Contact

Page generated Wed, 14 May 2025 12:16:09 +0000.