Out of Bounds Read Vulnerability in golang-github-gomarkdown-markdown Package
Summary
DEBIAN-CVE-2026-40890: The package github.com/gomarkdown/markdown is a Go library for parsing Markdown text and rendering as HTML. Affects golang-github-gomarkdown-markdown versions 0.0~git20220731.dcdaee8-2 – 0.0~git20231115.a660076-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The golang-github-gomarkdown-markdown package is a Go library designed for parsing Markdown text and rendering it as HTML. It is widely used in applications that require Markdown processing due to its efficiency and ease of integration. However, this package has been identified to have a vulnerability that can lead to serious issues when handling malformed input.
Vulnerability Detail
The vulnerability arises when the SmartypantsRenderer processes malformed input containing a '<' character that is not followed by a '>' character anywhere in the remaining text. This can lead to an Out of Bounds read or a panic, potentially causing application crashes or unexpected behavior. The issue is rooted in the way the library handles certain edge cases in Markdown parsing, making it critical for developers to address this vulnerability promptly.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can validate the input before processing it with the SmartypantsRenderer to ensure that it does not contain any malformed Markdown syntax. This can help prevent the vulnerability from being exploited until the package is updated.
Conclusion
The golang-github-gomarkdown-markdown package has a critical vulnerability that can lead to Out of Bounds reads or panics when processing malformed Markdown input. It is essential for developers to update their packages to the patched version to ensure application stability and security. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for golang-github-gomarkdown-markdown →
FAQ
The vulnerability is an Out of Bounds read or panic caused by processing malformed Markdown input.
All versions of the golang-github-gomarkdown-markdown package are affected, as the vulnerability was introduced from version 0.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Exploiting this vulnerability can lead to application crashes, unexpected behavior, and potential data exposure.
Yes, a patch is available. Updating to the latest version of the golang-github-gomarkdown-markdown package will resolve the issue.
References
Related vulnerabilities
Recent vulnerabilities recorded for golang-github-gomarkdown-markdown.
