Skip to main content

Inefficient Regular Expression Complexity


Severity High
Score 7.5/10


A vulnerability was found in markdown-it versions prior to 3.0.0. It has been classified as problematic. The vulnerable regex pattern is present in the "cdata" variable in the "lib/common/html_re.js" file. The manipulation leads to inefficient regular expression complexity. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-216852.

  • LOW
  • NONE
  • NONE
  • NONE
  • NONE
  • HIGH

CWE-1333 - Inefficient Regular Expression Complexity

The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.


Advisory Timeline

  • Published