Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
4 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Go github.com/gomarkdown/markdown < 0.0.0-20260724235538-61af6e1e6971
Fixed in
0.0.0-20260724235538-61af6e1e6971· Vendor fix available
Issue
IsSafeURL slices url[:nPath] before checking that len(url) = nPath, so a URL shorter than a path prefix (0, 1 or 2 bytes) triggers a slice-bounds panic, and this is reached end to end when the html.Safelink hardening flag is enabled and the input contains an empty or very short link destination, giving an unrecoverable crash DoS. Confirmed at HEAD (e08cff8; present since 2022). The defect parser/parser.go, IsSafeURL: url[:nPath] is evaluated before the nLink = nPath check. When len(url) < nPath and cap(url) < nPath, the slice expression panics. Only the relative-path loop is affected; the adjacent URIs loop is already correctly guarded (the signal that this one deviates, the same signal as the anchor). Input: IsSafeURL("") panics ([:1] cap 0), IsSafeURL(".") panics ([:2] cap 1), IsSafeURL("..") panics ([:3] cap 2), while IsSafeURL("/") returns true. End to end: markdown.ToHTML(input, html.CommonFlags|html.Safelink) with input x panics. Attacker model: (1) any service…
Recommended action: Upgrade to 0.0.0-20260724235538-61af6e1e6971 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/gomarkdown/markdown < 0.0.0-20260411013819-759bbc3e3207
Fixed in
0.0.0-20260411013819-759bbc3e3207· Vendor fix available
Issue
Processing a malformed input containing a < character that is not followed by a character anywhere in the remaining text with a SmartypantsRenderer will lead to Out of Bounds read or a panic. Details The smartLeftAngle() function in html/smartypants.go:367-376 performs an out-of-bounds slice operation when processing a < character that is not followed by a character anywhere in the remaining text. https://github.com/gomarkdown/markdown/blob/37c66b85d6ab025ba67a73ba03b7f3ef55859cca/html/smartypants.go#L367-L376 If the length of the slice is lower than its capacity, this leads to an extra byte of data read. If the length equals the capacity, this leads to a panic. PoC Impact This vulnerability will lead to a Denial of Service / panic on the processing service. -- The Datadog Security Team
Recommended action: Upgrade to 0.0.0-20260411013819-759bbc3e3207 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/gomarkdown/markdown < 0.0.0-20240729212818-a2a9c4f76ef5
Fixed in
0.0.0-20240729212818-a2a9c4f76ef5· Vendor fix available
Issue
The package github.com/gomarkdown/markdown is a Go library for parsing Markdown text and rendering as HTML. Prior to pseudoversion v0.0.0-20240729232818-a2a9c4f, which corresponds with commit a2a9c4f76ef5a5c32108e36f7c47f8d310322252, there was a logical problem in the paragraph function of the parser/block.go file, which allowed a remote attacker to cause a denial of service (DoS) condition by providing a tailor-made input that caused an infinite loop, causing the program to hang and consume resources indefinitely. Submit a2a9c4f76ef5a5c32108e36f7c47f8d310322252 contains fixes to this problem.
Recommended action: Upgrade to 0.0.0-20240729212818-a2a9c4f76ef5 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/gomarkdown/markdown < 0.0.0-20230922105210-14b16010c2ee
Fixed in
0.0.0-20230922105210-14b16010c2ee· Vendor fix available
Issue
Parsing malformed markdown input with parser that uses parser.Mmark extension could result in out-of-bounds read vulnerability. Details To exploit the vulnerability, parser needs to have parser.Mmark extension set. The panic occurs inside the citation.go file on the line 69 when the parser tries to access the element past its length. https://github.com/gomarkdown/markdown/blob/7478c230c7cd3e7328803d89abe591d0b61c41e4/parser/citation.go#L69 PoC Impact Denial of Service / panic
Recommended action: Upgrade to 0.0.0-20230922105210-14b16010c2ee (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.