CVE-2026-111759

{
  "etk_id": "ETK-2026-2074",
  "cve_id": "CVE-2026-111759",
  "display_id": "CVE-2026-111759",
  "ghsa_id": "GHSA-r7fv-28h4-cvq7",
  "euvd_id": "EUVD-2026-104538",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Quadratic-time smartquotes processing in markdown-it",
  "summary": "markdown-it versions before 14.3.2 and 15.0.2 can consume excessive CPU while parsing untrusted Markdown when typographer is enabled. An attacker able to submit Markdown for processing may cause denial of service through pathological quote patterns.",
  "mitigation": "Upgrade markdown-it to 14.3.2 or 15.0.2. Until upgrading, disable the typographer option when processing untrusted Markdown.",
  "vendor": "markdown-it",
  "product": "markdown-it",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 15.0.0, < 15.0.2"
      ],
      "ecosystem": "npm",
      "fixed_versions": [
        "15.0.2"
      ],
      "package_name": "markdown-it",
      "purl": "pkg:npm/markdown-it"
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        "< 14.3.2"
      ],
      "ecosystem": "npm",
      "fixed_versions": [
        "14.3.2"
      ],
      "package_name": "markdown-it",
      "purl": "pkg:npm/markdown-it"
    }
  ],
  "cwes": [
    400
  ],
  "cvss_score": 7.5,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
  "epss_score": 0.006,
  "epss_percentile": 0.4766,
  "epss_asof": "2026-10-20",
  "automation": "deterministic",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 27.081575566666668,
  "t0_at": "2026-10-19T17:39:10.264000+00:00",
  "signals": {
    "public_poc": {
      "at": "2026-09-12T06:00:24+00:00",
      "days": -37.48525768518518,
      "is_lower_bound": false,
      "measured_at": "2026-10-19T17:39:10.264000+00:00",
      "url": "https://github.com/markdown-it/markdown-it/security/advisories/GHSA-r7fv-28h4-cvq7"
    },
    "trigger_signal": {
      "at": "2026-10-19T17:39:10.264000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-19T17:39:10.264000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-111759"
    }
  }
}