RUSTSEC-2026-0433 json
Quadratic parsing of nested image wikilinks with `ENABLE_WIKILINKS`
published 14d ago modified 9d ago
- cvss
- 7.5
- version 3.1, OSV
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- —
- no score, EPSS covers CVEs only
- public exploits
- 0
- none known
Summary
With `Options::ENABLE_WIKILINKS`, handle_wikilink builds a wikilink's target from the raw text of its body: scan_wikilink_pipe walks it looking for |, then contains('\0') and from_replace_nuls walk it again. Once a wikilink is created, disable_all_links only disables Link entries, so every enclosing `![[` stays live on the wikilink stack. On `![[![[![[…]]]]]]` each of those openers then resolves in turn and rescans everything inside it, which is quadratic in the nesting depth. The event count stays tiny, because in the unpiped case each enclosing image replaces its body with a fresh text node, so all of that work is thrown away.
Applications that parse untrusted Markdown with `ENABLE_WIKILINKS` set, including through `Options::all()`, are affected. The option is off by default. Parsing without it is not affected.
The flaw was fixed in [#1186](https://github.com/pulldown-cmark/pulldown-cmark/pull/1186) and released in 0.13.6.
Patch / fix
Is RUSTSEC-2026-0433 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| OSV | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| crates.io | pulldown-cmark | >=0.13.0, <0.13.6 |
0.13.6 |
References
Sources
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.