CVE-2025-6493

A weakness has been identified in CodeMirror up to 5.65.20. Affected is an unknown function of the file mode/markdown/markdown.js of the component Markdown Mode. This manipulation causes inefficient regular expression complexity. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be exploited. Upgrading to version 6.0 is able to address this issue. You should upgrade the affected component. Not all code samples mentioned in the GitHub issue can be found. The repository mentions, that "CodeMirror 6 exists, and is [...] much more actively maintained."

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/6xxx/CVE-2025-6493.json",
    "cna_assigner": "VulDB",
    "cwe_ids": [
        "CWE-1333",
        "CWE-400"
    ]
}

References

Affected packages

Git / github.com/codemirror/codemirror5

Affected ranges

Type

GIT

Repo

https://github.com/codemirror/codemirror5

Events

Introduced

d60fff6750cd4963ebfd83d446d5bd3ad6b083a3

Last affected

b0c45cf0fbd3dc7cb2016a79fb81c723827f4e31

Database specific

{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "5.65.0"
        },
        {
            "last_affected": "5.65.0"
        },
        {
            "introduced": "5.65.1"
        },
        {
            "last_affected": "5.65.1"
        },
        {
            "introduced": "5.65.2"
        },
        {
            "last_affected": "5.65.2"
        },
        {
            "introduced": "5.65.3"
        },
        {
            "last_affected": "5.65.3"
        },
        {
            "introduced": "5.65.4"
        },
        {
            "last_affected": "5.65.4"
        },
        {
            "introduced": "5.65.5"
        },
        {
            "last_affected": "5.65.5"
        },
        {
            "introduced": "5.65.6"
        },
        {
            "last_affected": "5.65.6"
        },
        {
            "introduced": "5.65.7"
        },
        {
            "last_affected": "5.65.7"
        },
        {
            "introduced": "5.65.8"
        },
        {
            "last_affected": "5.65.8"
        },
        {
            "introduced": "5.65.9"
        },
        {
            "last_affected": "5.65.9"
        },
        {
            "introduced": "5.65.10"
        },
        {
            "last_affected": "5.65.10"
        },
        {
            "introduced": "5.65.11"
        },
        {
            "last_affected": "5.65.11"
        },
        {
            "introduced": "5.65.12"
        },
        {
            "last_affected": "5.65.12"
        },
        {
            "introduced": "5.65.13"
        },
        {
            "last_affected": "5.65.13"
        },
        {
            "introduced": "5.65.14"
        },
        {
            "last_affected": "5.65.14"
        },
        {
            "introduced": "5.65.15"
        },
        {
            "last_affected": "5.65.15"
        },
        {
            "introduced": "5.65.16"
        },
        {
            "last_affected": "5.65.16"
        },
        {
            "introduced": "5.65.17"
        },
        {
            "last_affected": "5.65.17"
        },
        {
            "introduced": "5.65.18"
        },
        {
            "last_affected": "5.65.18"
        },
        {
            "introduced": "5.65.19"
        },
        {
            "last_affected": "5.65.19"
        },
        {
            "introduced": "5.65.20"
        },
        {
            "last_affected": "5.65.20"
        }
    ]
}

Affected versions

5.*

5.65.0

5.65.1

5.65.10

5.65.11

5.65.12

5.65.13

5.65.14

5.65.15

5.65.16

5.65.17

5.65.18

5.65.19

5.65.2

5.65.20

5.65.3

5.65.4

5.65.5

5.65.6

5.65.7

5.65.8

5.65.9

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-6493.json"