CVE-2023-42821: Out-of-Bounds Read Vulnerability in github.com/gomarkdown/markdown
Summary
CVE-2023-42821: Parser out-of-bounds read caused by a malformed markdown input in github.com/gomarkdown/markdown. Affects github.com/gomarkdown/markdown versions < 0.0.0-20230922105210-14b16010c2ee. Fixed in 0.0.0-20230922105210-14b16010c2ee. How to fix ↓
Also tracked for
- golang-github-gomarkdown-markdown · Debian:12
The same CVE-2023-42821 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package github.com/gomarkdown/markdown is a Go library that provides functionality for parsing and rendering Markdown documents. It is commonly used in Go applications to handle Markdown input and generate HTML output. This package includes a parser that is responsible for processing Markdown syntax and converting it into structured data. However, a vulnerability has been discovered in the parser that can lead to an out-of-bounds read when processing malformed Markdown input.
Vulnerability Detail
The vulnerability in github.com/gomarkdown/markdown is caused by a parser out-of-bounds read. When the parser encounters a malformed Markdown input, it fails to properly handle the input, resulting in an out-of-bounds read operation. An attacker can exploit this vulnerability by crafting a specially crafted Markdown input that triggers the out-of-bounds read. This can lead to information disclosure or potentially allow the attacker to execute arbitrary code in the context of the application using the vulnerable library.
How To Fix
Latest published version: v0.0.0-20261022144421-6c848fa1b723 as of 23 Oct 2026
go get github.com/gomarkdown/markdown@v0.0.0-20261022144421-6c848fa1b723Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.0.0-20230922105210-14b16010c2ee
This is the first release that contains the fix.
go get github.com/gomarkdown/markdown@v0.0.0-20230922105210-14b16010c2eeTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to update to the fixed version of the package as soon as possible.
Conclusion
In conclusion, the package github.com/gomarkdown/markdown is vulnerable to an out-of-bounds read vulnerability when processing malformed Markdown input. Developers should update to the fixed version of the package to mitigate the risk of information disclosure or remote code execution. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/gomarkdown/markdown →
FAQ
This vulnerability can potentially lead to information disclosure or remote code execution in the context of the application using the vulnerable library.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your Gopkg.lock file and Vulert will analyze it for any open-source vulnerabilities, including this one.
At the time of this report, there are no known public exploits for this vulnerability. However, it is always recommended to update to the latest version of the package to mitigate any potential risks.
No, the only way to fully mitigate this vulnerability is to update to the fixed version of the package. It is not recommended to rely on workarounds or custom code modifications as they may not provide complete protection.
You can find more information about this vulnerability in the CVE entry with the identifier CVE-2023-42821 or on the VulnDB website.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/gomarkdown/markdown.
