| Package | Affected versions | Patched versions |
|---|---|---|
| commonmarker | < 0.23.6 | 0.23.6 |
CommonMarker uses cmark-gfm for rendering Github Flavored Markdown. A polynomial time complexity issue in cmark-gfm's autolink extension may lead to unbounded resource exhaustion and subsequent denial of service.
This vulnerability has been patched in the following CommonMarker release:
Disable use of the autolink extension.
https://github.com/gjtorikian/commonmarker/pull/190 https://github.com/github/cmark-gfm/security/advisories/GHSA-cgh3-p57x-9q7q https://en.wikipedia.org/wiki/Time_complexity
If you have any questions or comments about this advisory:
We would like to thank Legit Security for reporting this vulnerability.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free