markdown-it EUVD-2026-104595

Exploitation requires markdown-it to be instantiated with the 'html' option enabled OR the 'commonmark' preset active - this is a NON-DEFAULT configuration, as markdown-it ships with HTML parsing disabled, which is the primary limiting factor. The malicious constructs (repeated unterminated inline HTML comments '<!--', processing instructions '<?', declarations '<!A', or CDATA '<![CDATA[') must occur INSIDE a paragraph to reach src/rules_inline/html_inline.ts; HTML blocks are explicitly NOT affected. No authentication or user interaction is needed beyond getting attacker-controlled Markdown into the parser (CVSS PR:N/UI:N), so any app that renders untrusted Markdown with HTML enabled is exposed. The attack is high-complexity (AC:H) specifically because of the required non-default html/commonmark configuration.

This is a genuinely low-priority issue despite being a real, confirmed defect. All signals align downward rather than conflicting: the vendor-assigned CVSS is 3.7 (Low) with vector AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L - network-reachable and unauthenticated, but with high attack complexity and impact limited to availability only (CWE-400, quadratic processing). No confidentiality or integrity impact exists. No EPSS score was provided, so exploitation probability cannot be quantified from the input; the CVE is not in CISA KEV, and no standalone public exploit was supplied, though the fix commit (928bc8c1) ships pathological test payloads that concretely demonstrate the triggering input. The AC:H rating is well-justified: exploitation requires the non-default 'html' option or commonmark preset to be enabled, which materially shrinks the real-world attack surface since markdown-it ships with HTML disabled by default. The practical risk is a single-request event-loop stall / main-thread hang (self-inflicted DoS of the parsing worker or browser tab), not RCE, data theft, or worm-grade spread - appropriate to prioritize for patching on normal cadence rather than emergency response.

An application that renders user-supplied Markdown with markdown-it configured with html:true (or the commonmark preset) accepts a comment, post, or document from an attacker. The attacker submits a paragraph containing hundreds of thousands of repeated unterminated inline HTML comments (e.g. '<!--' repeated) with no closing terminator; markdown-it's html_inline rule repeatedly rescans the overlapping suffix for a terminator, producing quadratic work that blocks the Node.js event loop or freezes the browser main thread. The fix commit's pathological tests demonstrate the exact payloads, but no weaponized standalone exploit was provided in the input.