GHSA-4xf9-pgvv-xx67

Source

https://github.com/advisories/GHSA-4xf9-pgvv-xx67

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-4xf9-pgvv-xx67/GHSA-4xf9-pgvv-xx67.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-4xf9-pgvv-xx67

Withdrawn

2026-02-03T17:52:55Z

Published

2020-09-03T20:27:46Z

Modified

2026-02-03T18:02:39Z

Severity

5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVSS Calculator

Summary

Duplicate Advisory: Regular Expression Denial of Service in simple-markdown

Details

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-gpvj-gp8c-c7p2. This link is maintained to preserve external references.

Original Description

Versions of simple-markdown prior to 0.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS). The SimpleMarkdown.defaultInlineParse() function has significantly degraded performance when parsing inline code blocks.

Recommendation

Upgrade to version 0.5.2 or later.

Database specific

{
    "cwe_ids": [
        "CWE-400"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2020-08-31T18:49:00Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
}

References

Affected packages

npm / simple-markdown

Package

Name: simple-markdown; View open source insights on deps.dev
Purl: pkg:npm/simple-markdown

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.5.2

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-4xf9-pgvv-xx67/GHSA-4xf9-pgvv-xx67.json"