RSEC-2023-7
Denial of Service (DoS) and Arbitrary Code Execution (ACE) vulnerabilities
Published Oct 6, 2023 · updated May 19, 2025
cmark-gfm, GitHub's extended CommonMark library, has multiple vulnerabilities. Versions prior to 0.29.0.gfm.6 suffer from a polynomial time complexity issue in the autolink extension, causing denial of service. Also, versions before 0.29.0.gfm.3 and 0.28.3.gfm.21 contain an integer overflow in table row parsing, leading to heap corruption and potential Arbitrary Code Execution. Patches are available in versions 0.29.0.gfm.6, 0.29.0.gfm.3, and 0.28.3.gfm.21. Mitigations include upgrading or disabling affected extensions.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Oct 6, 2023 · OSV.dev
Detected
cmark-gfm, GitHub's extended CommonMark library, has multiple vulnerabilities. Versions prior to 0.29.0.gfm.6 suffer from a polynomial time complexity issue in the autolink extension, causing denial of service. Also, versions before 0.29.0.gfm.3 and 0.28.3.gfm.21 contain an integer overflow in table row parsing, leading to heap corruption and potential Arbitrary Code Execution. Patches are availab
May 19, 2025 · OSV.dev
Fix available
commonmark fixed in 1.8
May 19, 2025 · OSV.dev
Fix available
commonmark fixed in 1.8
May 19, 2025 · OSV.dev
Updated
cmark-gfm, GitHub's extended CommonMark library, has multiple vulnerabilities. Versions prior to 0.29.0.gfm.6 suffer from a polynomial time complexity issue in the autolink extension, causing denial of service. Also, versions before 0.29.0.gfm.3 and 0.28.3.gfm.21 contain an integer overflow in table row parsing, leading to heap corruption and potential Arbitrary Code Execution. Patches are availab
Affected
- CRAN commonmark0.2 → 1.8