CVE-2026-40890

high

Description

The package `github.com/gomarkdown/markdown` is a Go library for parsing Markdown text and rendering as HTML. Processing a malformed input containing a < character that is not followed by a > character anywhere in the remaining text with a SmartypantsRenderer will lead to Out of Bounds read or a panic. This vulnerability is fixed with commit 759bbc3e32073c3bc4e25969c132fc520eda2778.

References

https://github.com/gomarkdown/markdown/security/advisories/GHSA-77fj-vx54-gvh7

https://github.com/gomarkdown/markdown/commit/759bbc3e32073c3bc4e25969c132fc520eda2778

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-24280

Details

Source: Mitre, NVD

Published: 2026-04-21

Updated: 2026-04-27

Named Vulnerability: GO-2026-5208Named Vulnerability: GHSA-77fj-vx54-gvh7

Risk Information

CVSS v2

Base Score: 7.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C

Severity: High

CVSS v3

Base Score: 7.5

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Severity: High

EPSS

EPSS: 0.00515