RUSTSEC-2026-0433

See a problem?
Please try reporting it to the source first.

Source

https://rustsec.org/advisories/RUSTSEC-2026-0433

Import Source

https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0433.json

JSON Data

https://api.osv.dev/v1/vulns/RUSTSEC-2026-0433

Published

2026-10-28T12:00:00Z

Modified

2026-11-02T11:30:18Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Summary

Quadratic parsing of nested image wikilinks with `ENABLE_WIKILINKS`

Details

With Options::ENABLE_WIKILINKS, handle_wikilink builds a wikilink's target from the raw text of its body: scan_wikilink_pipe walks it looking for |, then contains('\0') and from_replace_nuls walk it again. Once a wikilink is created, disable_all_links only disables Link entries, so every enclosing ![[ stays live on the wikilink stack. On ![[![[![[…]]]]]] each of those openers then resolves in turn and rescans everything inside it, which is quadratic in the nesting depth. The event count stays tiny, because in the unpiped case each enclosing image replaces its body with a fresh text node, so all of that work is thrown away.

Applications that parse untrusted Markdown with ENABLE_WIKILINKS set, including through Options::all(), are affected. The option is off by default. Parsing without it is not affected.

The flaw was fixed in #1186 and released in 0.13.6.

Database specific

{
    "license":  "CC0-1.0"
}

References

Affected packages

crates.io / pulldown-cmark

Package

Name: pulldown-cmark; View open source insights on deps.dev
Purl: pkg:cargo/pulldown-cmark

Affected ranges

Type: SEMVER
Events: Introduced

0.13.0

Fixed

0.13.6

Ecosystem specific

{
    "affected_functions":  null,
    "affects":  {
        "arch":  [],
        "functions":  [],
        "os":  []
    }
}