{"action":"Upgrade markdown-it to 14.3.3 or later.","affected":[{"fixed":"14.3.3","introduced":"14.1.0"},{"fixed":"15.0.3","introduced":"15.0.0"}],"component":"markdown-it","cve_ids":["CVE-2026-111758"],"ecosystem":"npm","exploited":false,"fixed_versions":["14.3.3","15.0.3"],"ghsa_id":"GHSA-gfr2-rv44-r23c","id":"tcs_01M5JK8ZVRVJ0C503JYS8QFXPZ","modified_at":"2026-10-20T20:45:05.953469039Z","published_at":"2026-10-20T20:28:44Z","references":["https://osv.dev/vulnerability/GHSA-gfr2-rv44-r23c","https://github.com/markdown-it/markdown-it/security/advisories/GHSA-gfr2-rv44-r23c","https://github.com/markdown-it/markdown-it/commit/48fbc465812c440020c663f040ab22deaf8f1eca","https://github.com/markdown-it/markdown-it/commit/d99f48839d37af6fd8a2617516c43dab90755503","https://github.com/markdown-it/markdown-it","https://github.com/markdown-it/markdown-it/releases/tag/14.3.3","https://github.com/markdown-it/markdown-it/releases/tag/15.0.3"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-gfr2-rv44-r23c","url":"https://osv.dev/vulnerability/GHSA-gfr2-rv44-r23c"}],"summary":"markdown-it: Quadratic-time rendering of a single multi-line link reference definition with default options (regression since 14.0)"}