npm/markdown-it: medium
markdown-it linkify: true has two quadratic paths, so a few hundred KB of markdown blocks the event loop for tens of seconds
Action: Upgrade markdown-it to 14.3.1 or later.
npm i markdown-it@15.0.1npm i markdown-it@14.3.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 15.0.0 | 15.0.1 | - |
| 0 | 14.3.1 | - |
Fixed versions
| 15.0.1 | 14.3.1 |
Sources
- osv: GHSA-253c-mchw-3w2r
- https://github.com/markdown-it/markdown-it/security/advisories/GHSA-253c-mchw-3w2r
- https://github.com/markdown-it/markdown-it/commit/09fa07118dda4c953f058848f53dae88395618ca
- https://github.com/markdown-it/markdown-it/commit/aaadcfa6d817b3c5f89afb49d97c7b797a6dd4fd
- https://github.com/markdown-it/markdown-it/commit/ad70f6b7cff64bee10e42a774147112480ca0d49
- https://github.com/markdown-it/markdown-it
published · modified · JSON