medium5.3
CVE-2024-1899
Showdown vulnerable to Regular Expression Denial of Service (ReDoS) in link/anchor parsing
Impact
Showdownjs, versions <= 2.1.0, `anchors` subparser used to parse links has a nested regular expression which can lead to denial of service conditions given malicious input.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | showdown | <= 2.1.0 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Showdownjs | Showdown | through 2.1.0 |