CVE-2026-48988 Details
Description
markdown-it is a Markdown parser. Versions 14.1.1 and below contain a denial-of-service vulnerability when typographer: true is enabled, due to quadratic (O(n^2)) processing in the smartquotes rule. The issue stems from repeatedly modifying strings with replaceAt(), which performs O(n) slicing and concatenation per quote character. This can cause excessive CPU consumption when parsing quote-heavy, user-supplied markdown and may let attackers degrade or disrupt service availability. Although typographer is disabled by default, many production apps enable it for smart typography, making the issue relevant. This issue has been fixed in version 14.2.0.
A denial-of-service vulnerability has been identified in the markdown-it library, specifically in versions through 14.1.1. The issue arises when the typographer option is enabled, leading to quadratic time complexity in the smartquotes rule. This vulnerability allows attackers to craft markdown input with excessive quotation marks, causing the parser to consume significant CPU resources and disrupt service availability. Although the typographer option is off by default, it is commonly enabled in production applications for improved typography, making this vulnerability relevant.
Users can upgrade to markdown-it version 14.2.0, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 18, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/markdown-it/markdown-it/security/advisories/GHSA-6v5v-wf23-fmfq | CISA-ADP | ExploitMitigationVendor Advisory |
| https://github.com/markdown-it/markdown-it/commit/9ce2087562c45d1e5ddd9f76b990f4b3fbe040e5 | [email protected] | Patch |
| https://github.com/markdown-it/markdown-it/security/advisories/GHSA-6v5v-wf23-fmfq | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-400 | Uncontrolled Resource Consumption | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| markdown-it project markdown-it | < 14.2.0 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 24, 2026 | Initial Analysis | [email protected] |
| Jun 18, 2026 | CVE Modified | CISA-ADP |
| Jun 17, 2026 | New CVE Received | [email protected] |