{"id":"CVE-2026-102941","kind":"vulnerability","aliases":["CVE-2026-102941"],"related":[],"title":"Go markdown library: short link destination crashes the rendering process","description":"The package github.com/gomarkdown/markdown is a Go library for parsing Markdown text and rendering as HTML. Prior to 0.0.0-20260724235538-61af6e1e6971, parser.IsSafeURL in parser/parser.go slices url[:nPath] before the len(url) >= nPath guard. A short destination causes a slice-bounds panic when the loop reaches a relative-path prefix for which len(url) < nPath and cap(url) < nPath. The one-byte destination / is an explicit non-panic counterexample because it matches the first valid path and returns before a longer prefix is sliced. Demonstrated panic cases include empty, ., and .. destinations under those conditions. The panic is reachable when markdown.ToHTML renders untrusted Markdown with html.Safelink enabled, including an empty link destination, and is also reachable by callers that pass a short attacker-controlled URL directly to the exported parser.IsSafeURL function. An uncaught panic can terminate the calling process and cause denial of service. This issue is fixed in 0.0.0-20260724235538-61af6e1e6971.","summary":"A Go Markdown library panics on certain short link destinations when html.Safelink is enabled, because IsSafeURL slices past the end of the input. An attacker who can submit Markdown to a service that renders it can crash the calling process, causing denial of service.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["go","markdown","package","self-hosted","web-app"],"not_affected_if":["safelink-disabled","trusted-input-only"],"how_to_check":"- Run `go list -m github.com/gomarkdown/markdown` in the project to see the version in use.\n- Search the go.mod and go.sum files for `github.com/gomarkdown/markdown`.\n- Check whether the code calls `markdown.ToHTML` with `html.Safelink` enabled, or calls `parser.IsSafeURL` directly on user input.","fix":"- Upgrade github.com/gomarkdown/markdown to `0.0.0-20260724235538-61af6e1e6971` or later.\n- Until upgraded, disable `html.Safelink` or recover panics around rendering of untrusted Markdown.","status":"open","published_at":"2026-10-16T16:16:52+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","triaged_at":"2026-10-25T03:25:06+00:00","updated_at":"2026-10-25T03:25:06+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T03:25:06Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade github.com/gomarkdown/markdown to `0.0.0-20260724235538-61af6e1e6971` or later.\n- Until upgraded, disable `html.Safelink` or recover panics around rendering of untrusted Markdown.","reach":"internet","title":"Go markdown library: short link destination crashes the rendering process","impact":"low","summary":"A Go Markdown library panics on certain short link destinations when html.Safelink is enabled, because IsSafeURL slices past the end of the input. An attacker who can submit Markdown to a service that renders it can crash the calling process, causing denial of service.","category":"package","nicknames":[],"who_cares":["go","markdown","self-hosted","web-app"],"confidence":0.7,"needs_auth":"unknown","worst_case":"Crashes the calling process, causing denial of service","analyst_note":"","how_to_check":"- Run `go list -m github.com/gomarkdown/markdown` in the project to see the version in use.\n- Search the go.mod and go.sum files for `github.com/gomarkdown/markdown`.\n- Check whether the code calls `markdown.ToHTML` with `html.Safelink` enabled, or calls `parser.IsSafeURL` directly on user input.","needs_analyst":false,"not_affected_if":["trusted-input-only","safelink-disabled"],"who_is_affected":"Applications that render untrusted Markdown with the gomarkdown library and have html.Safelink enabled are exposed, since an empty or very short link destination triggers the panic. Callers that pass attacker-controlled URLs straight to the exported parser.IsSafeURL are also exposed. Projects that only render trusted Markdown, or that do not use Safelink and do not call IsSafeURL directly, can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000682,"input_tokens":3587,"output_tokens":647,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-102941':13A,16A '-2026':12A,15A '-20260724235538':90C,225C '-61':91C,226C '/gomarkdown/markdown':74C '0.0.0':89C,224C 'af6e1e6971':92C,227C 'also':188C 'app':25B 'attack':50B,197C 'attacker-control':196C 'bound':112C 'byte':135C 'call':64B,212C 'caller':191C 'cap':129C 'case':161C 'caus':66B,108C,215C 'certain':32B 'condit':168C 'control':198C 'counterexampl':143C 'crash':7A,62B 'cve':11A,14A 'demonstr':159C 'denial':67B,216C 'destin':6A,35B,107C,136C,165C,185C 'direct':200C 'empti':163C,183C 'enabl':39B,180C 'end':45B 'explicit':139C 'export':203C 'first':148C 'fix':222C 'function':205C 'github.com':73C 'github.com/gomarkdown/markdown':72C 'go':1A,17B,27B,77C 'guard':104C 'host':22B 'html':86C 'html.safelink':37B,179C 'includ':162C,181C 'input':48B 'issafeurl':41B 'issu':220C 'len':101C,125C 'librari':3A,29B,78C 'link':5A,34B,184C 'longer':155C 'loop':116C 'markdown':2A,18B,28B,54B,81C,177C 'markdown.tohtml':174C 'match':146C 'non':141C 'non-pan':140C 'npath':98C,103C,127C,131C 'one':134C 'one-byt':133C 'packag':19B,71C 'panic':30B,113C,142C,160C,170C,208C 'pars':80C 'parser.issafeurl':93C,204C 'parser/parser.go':95C 'pass':193C 'past':43B 'path':121C,150C 'prefix':122C,156C 'prior':87C 'process':10A,65B,213C 'reach':117C 'reachabl':172C,189C 'relat':120C 'relative-path':119C 'render':9A,59B,84C,175C 'return':152C 'self':21B 'self-host':20B 'servic':57B,69B,218C 'short':4A,33B,106C,195C 'slice':42B,96C,111C,158C 'slice-bound':110C 'submit':53B 'termin':210C 'text':82C 'uncaught':207C 'untrust':176C 'url':97C,102C,126C,130C,199C 'valid':149C 'web':24B 'web-app':23B","nicknames":[],"mitigations":[],"who_affected":"Applications that render untrusted Markdown with the gomarkdown library and have html.Safelink enabled are exposed, since an empty or very short link destination triggers the panic. Callers that pass attacker-controlled URLs straight to the exported parser.IsSafeURL are also exposed. Projects that only render trusted Markdown, or that do not use Safelink and do not call IsSafeURL directly, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T16:16:52+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-102941","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102941","severity":null,"published_at":"2026-10-16T16:16:52+00:00","modified_at":"2026-10-16T20:04:29+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}