CVE-2015-10005 json
markdown-it html_re.js redos
published 3y ago modified 4mo ago also GHSA-j5p7-jf4q-742q , EUVD-2022-7658
- cvss
- 3.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.0%
- EPSS 1.0% chance of exploitation in 30 days, percentile 63%
- public exploits
- 0
- none known
Summary
A vulnerability was found in markdown-it up to 2.x. It has been classified as problematic. Affected is an unknown function of the file lib/common/html_re.js. The manipulation leads to inefficient regular expression complexity. Upgrading to version 3.0.0 is able to address this issue. The name of the patch is 89c8620157d6e38f9872811620d25138fc9d1b0d. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-216852.
Patch / fix
- npm markdown-it 3.0.0
- markdown-it_project markdown-it 3.0.0
Is CVE-2015-10005 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- last yr.
Exploit prediction
1.03% chance of exploitation in the next 30 days, higher than 63% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 3.5 | CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L |
| CNA | 3.0 | 3.5 | CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L |
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| GitHub | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | markdown-it | <3.0.0 |
3.0.0 |
Affected products
- n/a markdown-it
Classification
- Weakness
-
- CWE-1333 Inefficient Regular Expression Complexity
References
-
github.com
/markdown-it/markdown-it/commit/89c8620157d6e38f9872811620d25138fc9d1b0d
patch, web, third-party-advisory
-
github.com
/markdown-it/markdown-it/releases/tag/3.0.0
patch, web, release-notes, third-party-advisory
-
vuldb.com
/?id.216852
vdb-entry, web, third-party-advisory
-
vuldb.com
/?ctiid.216852
signature, permissions-required, web, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2015-10005
advisory
-
github.com
/markdown-it/markdown-it
package
Sources
- CVE List CVE-2015-10005
- GitHub Advisory GHSA-j5p7-jf4q-742q
- NVD CVE-2015-10005
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.