markdown-it is a Markdown parser. From versions 14.1.0 to before 14.3.3, and 15.0.0 to before 15.0.3, a link reference definition whose label or title is never closed is O(n²) with default options. Continuation lines are pulled lazily with str += lineContent in src/rules_block/reference.ts, and the subsequent charCodeAt and slice calls flatten the V8 cons-string, copying everything collected so far; this runs before the rule decides the definition is invalid. No options are required to trigger it. This issue has been patched in versions 14.3.3 and 15.0.3.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - markdown-it is a Markdown parser. From versions 14.1.0 to before 14.3.3, and 15.0.0 to before 15.0.3, a
    link reference definition whose label or title is never closed is O(n²) with default options. Continuation
    lines are pulled lazily with str += lineContent in src/rules_block/reference.ts, and the subsequent
    charCodeAt and slice calls flatten the V8 cons-string, copying everything collected so far; this runs
    before the rule decides the definition is invalid. No options are required to trigger it. This issue has
    been patched in versions 14.3.3 and 15.0.3. (CVE-2026-111758)

ID	Name	Product	Family	Type	Severity
476573	Chainguard: multiple kibana-9.3 packages: security update to 9.3.8-r7	Tenable Cloud Security	Chainguard Local Security Checks	Local	high
476573	Chainguard: multiple kibana-9.3 packages: security update to 9.3.8-r7	Tenable Self-Hosted Container Security	Chainguard Local Security Checks	Local	high
476402	SCA: security update for markdown-it (GHSA-gfr2-rv44-r23c)	Tenable Cloud Security	SCA Checks	Local	high
476402	SCA: security update for markdown-it (GHSA-gfr2-rv44-r23c)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2026-111758

high

Tenable Plugins

high

high

high

high