CVE-2024-1899: Showdown Package Vulnerable to ReDoS in Link Parsing
Summary
CVE-2024-1899: Showdown vulnerable to Regular Expression Denial of Service (ReDoS) in link/anchor parsing. Affects showdown versions < 2.1.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Showdown is a popular JavaScript library used for converting Markdown into HTML. It is widely utilized in web applications for its ease of use and flexibility. The library includes various features for parsing and rendering Markdown, making it a go-to choice for developers looking to integrate Markdown support into their projects. However, certain versions of Showdown, specifically those up to 2.1.0, contain a vulnerability that can be exploited through malicious input, leading to potential denial of service conditions.
Vulnerability Detail
The vulnerability in Showdown arises from a nested regular expression used in the anchors subparser for link parsing. This design flaw can be exploited by attackers who provide specially crafted input, causing the regular expression engine to enter a catastrophic backtracking state. As a result, the application may become unresponsive, leading to denial of service. This vulnerability is classified under CWE-674 (Uncontrolled Recursion) and CWE-777 (Insecure Fallback).
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If immediate upgrading is not feasible, consider sanitizing user input to prevent malicious patterns from being processed by the anchors subparser. Implementing input validation can help mitigate the risk until an upgrade is performed.
Conclusion
The vulnerability identified as CVE-2024-1899 in the Showdown package poses a risk of denial of service due to a flaw in the link parsing mechanism. Users are advised to update to version 2.1.1 or later to mitigate this risk. Additionally, implementing input validation can serve as a temporary workaround until the update is applied.
See every vulnerability recorded for showdown →
FAQ
The CVSS score for this vulnerability is 5.3, indicating a moderate severity level.
Showdown versions up to and including 2.1.0 are affected by this vulnerability.
You can use Vulert, which monitors open-source vulnerabilities in your software. By analyzing your package-lock.json file, Vulert can alert you to any vulnerabilities, including this one.
Yes, you can implement input validation and sanitization to prevent malicious input from being processed by the vulnerable subparser.
Detailed information about this vulnerability can be found in the advisory published on GitHub and other security databases.
Related vulnerabilities
Recent vulnerabilities recorded for showdown.
