markdown-it EUVD-2026-105358

Triggered against default configurations - the advisory explicitly states 'No options are required to trigger it,' so no non-default feature or setting is needed. The one concrete prerequisite is that the target application must pass attacker-controlled Markdown text to markdown-it's parser (inline parsing does not even need to be enabled; block-only parsing is still quadratic). The specific input is a link reference definition (a line beginning with '[') whose label or title is never closed, spanning many continuation lines. Limiting factors that reduce realistic risk: the attacker needs to supply a sizeable payload - impact is negligible at small sizes and only becomes seconds-to-minutes of CPU at ~200 KB-800 KB - so endpoints that cap request/body size or Markdown input length sharply blunt exploitation; impact is confined to CPU/time (no memory-unbounded crash, no data exposure); and only markdown-it versions 14.1.0-14.3.2 and 15.0.0-15.0.2 are affected (13.x and the patched 14.3.3/15.0.3 are not).

This is a genuine but bounded availability risk. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) is internally consistent with the description: markdown-it is a library, so when an application exposes Markdown parsing to untrusted input the flaw is reachable over the network with low complexity and no authentication or user interaction, and the impact is purely availability (CWE-400 resource exhaustion), matching C:N/I:N/A:H. The GHSA advisory includes a working proof-of-concept with concrete measurements (200 KB → 3.6 s, 400 KB → 18.1 s, 800 KB → 74 s, roughly 4-5× per doubling), so publicly available exploit code exists. However, this is NOT confirmed actively exploited - there is no CISA KEV listing in the input and no EPSS score was provided, so real-world exploitation probability cannot be quantified from the data supplied. SSVC-style reasoning: technical impact is partial (single-event CPU stall, no code execution or data impact) and the flaw is automatable (trivially scriptable large payloads), but the practical ceiling is a CPU-bound slowdown rather than full outage per request. Net: treat as a real patch-worthy priority for any service that parses attacker-supplied Markdown, but it is a lower urgency than a code-execution or KEV-listed flaw - a legitimately high-CVSS availability bug rather than an emergency.

An attacker submits a single large Markdown document (hundreds of KB) containing a link reference definition whose label or title is never closed to any endpoint that renders user-supplied Markdown with markdown-it (e.g. a comment, issue, chat, or wiki field). Because of the O(n²) string-flattening behavior, parsing an ~800 KB payload consumes roughly 74 seconds of CPU on one thread; repeated submissions can stall or exhaust the server's event loop. A proof-of-concept is published in the GHSA advisory, so weaponizing this requires no original research.