{"id":"CVE-2026-111766","title":"markdown-it: Quadratic-time denial of service in inline HTML parsing with html enabled","summary":"markdown-it is a Markdown parser. Prior to 14.3.3 and 15.0.3, when the html option or commonmark preset is enabled and the constructs occur inside a paragraph, attacker-controlled Markdown containing repeated unterminated inline HTML com…","severity":"low","cvss":3.7,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","cvssSource":"cna","cwe":["CWE-400","CWE-407"],"vendor":"markdown-it","product":"markdown-it","affected":["markdown-it >= 15.0.0, < 15.0.3","markdown-it < 14.3.3"],"published":"2026-10-19","updated":"2026-10-19","sourceUpdated":"2026-10-19T19:47:46.488Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-111766","references":[{"url":"https://github.com/markdown-it/markdown-it/security/advisories/GHSA-vfgh-jcmw-g37q","label":"https://github.com/markdown-it/markdown-it/security/advisories/GHSA-vfgh-jcmw-g37q"},{"url":"https://github.com/markdown-it/markdown-it/commit/928bc8c11ded60181c0e7fc5aa954eec582e8e79","label":"https://github.com/markdown-it/markdown-it/commit/928bc8c11ded60181c0e7fc5aa954eec582e8e79"},{"url":"https://github.com/markdown-it/markdown-it/commit/d99f48839d37af6fd8a2617516c43dab90755503","label":"https://github.com/markdown-it/markdown-it/commit/d99f48839d37af6fd8a2617516c43dab90755503"},{"url":"https://github.com/markdown-it/markdown-it/releases/tag/14.3.3","label":"https://github.com/markdown-it/markdown-it/releases/tag/14.3.3"},{"url":"https://github.com/markdown-it/markdown-it/releases/tag/15.0.3","label":"https://github.com/markdown-it/markdown-it/releases/tag/15.0.3"}],"tags":["cve.org"],"ingestedAt":"2026-10-19T20:41:18.453Z","slug":"CVE-2026-111766","body":"## Overview\n\nmarkdown-it is a Markdown parser. Prior to 14.3.3 and 15.0.3, when the html option or commonmark preset is enabled and the constructs occur inside a paragraph, attacker-controlled Markdown containing repeated unterminated inline HTML comments, processing instructions, declarations, or CDATA sections reaches src/rules_inline/html_inline.ts. Its HTML_TAG_RE match searches the remaining suffix for the appropriate terminator; when no terminator is present, parsing advances to the next opener and repeats the match over overlapping input, causing quadratic processing and denial of service through event-loop blocking or an unresponsive browser main thread. HTML blocks and the default HTML-disabled configuration are not affected by these payloads. This issue is fixed in versions 14.3.3 and 15.0.3.\n\n## Affected\n\n- `markdown-it >= 15.0.0, < 15.0.3`\n- `markdown-it < 14.3.3`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":20,"depthScoreParts":{"impact":20.4,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}