markdown-it EUVD-2026-104538

Requires the consuming application to configure markdown-it with typographer: true (the smartquotes typographic replacement feature), which is NOT the default (default typographer: false is unaffected) - the advisory notes this option is nonetheless commonly enabled. The application must also pass attacker-controlled/untrusted Markdown into the parser. The specific trigger is input containing many opening double quotes followed by unmatched closing single quotes (or the same with quote types reversed), which forces repeated scans of the entire opener stack (quadratic time). Limiting factors: non-default configuration required, impact is availability/CPU exhaustion only (no code execution or data exposure), and affected versions are those prior to 14.3.2 and 15.0.2.

This is a CWE-400 uncontrolled resource consumption (algorithmic complexity) flaw in markdown-it's smartquotes rule. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5 HIGH) is availability-only - no confidentiality or integrity impact - reflecting a denial-of-service, not RCE or data exposure. The network vector and lack of required privileges or user interaction are plausible because markdown-it is typically invoked server-side on user-submitted content, so an unauthenticated remote user can supply the malicious Markdown. However, a critical caveat tempers the PR:N/AC:L reading: exploitation is gated on the application running with typographer: true, which is NOT the default (typographer: false). This is a deployment precondition rather than an attack complexity factor, so it does not lower the CVSS AC, but defenders must verify their own configuration. No EPSS score, SSVC decision, KEV listing, or explicit POC flag was provided in the input. The commit evidence includes a pathological test case ('"a '.repeat(100000) + "b' ".repeat(100000)) that demonstrates the trigger, so a working trigger pattern is effectively public via the upstream fix, but there is no indication of active exploitation. Net: a genuine, easily-triggered DoS against affected configurations, but availability-only and config-dependent - a real priority for services that parse untrusted Markdown with typographer enabled, lower priority for default deployments.

An application (e.g., a comment system, wiki, or chat renderer) uses markdown-it with typographer: true to render user-submitted content. A remote unauthenticated attacker posts a message containing many opening double quotes followed by unmatched closing single quotes, forcing the smartquotes rule into repeated full scans of the opener stack. The quadratic processing time pins a CPU core and stalls or hangs the request, and repeated submissions can exhaust server resources. The upstream pathological test demonstrates the exact trigger pattern.