GHSA-r7fv-28h4-cvq7: High severity npm/markdown-it vulnerability
Impact
When typographer: true is enabled, specially crafted Markdown can cause quadratic processing time in the smartquotes rule, potentially leading to denial of service in applications processing untrusted input.
Many opening double quotes followed by unmatched closing single quotes cause repeated scans of the entire opener stack. The same issue occurs with the quote types reversed.
The default configuration (typographer: false) is not affected, but this option is enabled with high probability.
Reproduction
js import MarkdownIt from 'markdown-it' import { performance } from 'node:perfhooks'
const md = new MarkdownIt({ typographer: true })
for (const k of [2000, 4000, 8000, 16000, 32000]) { const input = '"a '.repeat(k) + "b' ".repeat(k) const start = performance.now() md.render(input) console.log(input.length, (performance.now() - start).toFixed(1), 'ms') }
Result:
|input size|time| |-|-| |12000|18ms| |24000|47ms| |48000|115ms| |96000|428ms| |192000|1586ms|
Patches
Fixed in 15.0.2 and 14.3.2.
Workarounds
Disable typography with typographer: false, or disable only the smartquotes rule:
js md.disable('smartquotes')
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/markdown-itto a version that resolves this vulnerability.Fixed in 14.3.2 - Upgrade
Upgrade
npm/markdown-itto a version that resolves this vulnerability.Fixed in 15.0.2 - Upgrade
Upgrade
markdown-itto a version that resolves this vulnerability.Fixed in 15.0.2 - Upgrade
Upgrade
markdown-itto a version that resolves this vulnerability.Fixed in 14.3.2 - Configuration
Disable typography by setting typographer: false, or disable only the smartquotes rule with md.disable('smartquotes').
MarkdownIt typographer / smartquotes = false / disabled
Event History
Frequently Asked Questions
Which deployments are exposed to this denial-of-service issue?
Applications using npm/markdown-it to process untrusted Markdown are exposed when they enable typographer: true. The default configuration, typographer: false, is not affected.
What does an attacker need to submit to trigger the issue?
An attacker only needs to provide specially crafted Markdown containing many opening double quotes followed by unmatched closing single quotes, or the reverse quote arrangement. No authentication or user interaction is required according to the supplied severity vector.
What can be done if updating markdown-it is not immediately possible?
Disable typography by setting typographer: false, or disable only the smartquotes rule with md.disable('smartquotes'). Either workaround prevents the affected smartquotes processing path.
Which versions contain fixes?
The issue is fixed in markdown-it versions 15.0.2 and 14.3.2.