Live › vulnerability › CVE-2026-102941
Go to dashboardA Go Markdown library panics on certain short link destinations when html.Safelink is enabled, because IsSafeURL slices past the end of the input. An attacker who can submit Markdown to a service that renders it can crash the calling process, causing denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Applications that render untrusted Markdown with the gomarkdown library and have html.Safelink enabled are exposed, since an empty or very short link destination triggers the panic. Callers that pass attacker-controlled URLs straight to the exported parser.IsSafeURL are also exposed. Projects that only render trusted Markdown, or that do not use Safelink and do not call IsSafeURL directly, can skip it.
No product ranges from the sources yet.
go list -m github.com/gomarkdown/markdown in the project to see the version in use.github.com/gomarkdown/markdown.markdown.ToHTML with html.Safelink enabled, or calls parser.IsSafeURL directly on user input.0.0.0-20260724235538-61af6e1e6971 or later.html.Safelink or recover panics around rendering of untrusted Markdown.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The package github.com/gomarkdown/markdown is a Go library for parsing Markdown text and rendering as HTML. Prior to 0.0.0-20260724235538-61af6e1e6971, parser.IsSafeURL in parser/parser.go slices url[:nPath] before the len(url) >= nPath guard. A short destination causes a slice-bounds panic when the loop reaches a relative-path prefix for which len(url) < nPath and cap(url) < nPath. The one-byte destination / is an explicit non-panic counterexample because it matches the first valid path and returns before a longer prefix is sliced. Demonstrated panic cases include empty, ., and .. destinations under those conditions. The panic is reachable when markdown.ToHTML renders untrusted Markdown with html.Safelink enabled, including an empty link destination, and is also reachable by callers that pass a short attacker-controlled URL directly to the exported parser.IsSafeURL function. An uncaught panic can terminate the calling process and cause denial of service. This issue is fixed in 0.0.0-20260724235538-61af6e1e6971.
This page as .md · .json · in your agent: get_signal("CVE-2026-102941")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.