Vulnpedia
← Search CVEs

CVE-2026-102941

HIGH 7.5

Published 2026-10-16 · Last modified 2026-10-16

The package github.com/gomarkdown/markdown is a Go library for parsing Markdown text and rendering as HTML. Prior to 0.0.0-20260724235538-61af6e1e6971, parser.IsSafeURL in parser/parser.go slices url[:nPath] before the len(url) >= nPath guard. A short destination causes a slice-bounds panic when the loop reaches a relative-path prefix for which len(url) < nPath and cap(url) < nPath. The one-byte destination / is an explicit non-panic counterexample because it matches the first valid path and returns before a longer prefix is sliced. Demonstrated panic cases include empty, ., and .. destinations under those conditions. The panic is reachable when markdown.ToHTML renders untrusted Markdown with html.Safelink enabled, including an empty link destination, and is also reachable by callers that pass a short attacker-controlled URL directly to the exported parser.IsSafeURL function. An uncaught panic can terminate the calling process and cause denial of service. This issue is fixed in 0.0.0-20260724235538-61af6e1e6971.

ELEVATED IMPACT

Severe if exploited (CVSS 7.5), but no known exploitation and low modeled probability. Patch on a normal cadence.

Exploitation likelihood

0.3%chance of exploitation in 30 days · 20th percentile

○ In CISA KEV ○ Catalogued PoC

Impact if exploited

7.5CVSS 3.1 · HIGH

  • ConfidentialityNone
  • IntegrityNone
  • AvailabilityHigh

What an attacker needs

  • ✓Access: Reachable over the network — no local access needed
  • ✓Privileges: No account or privileges required
  • ✓User interaction: No user interaction needed
  • ✓Complexity: No special conditions — reliably repeatable

✓ lowers the bar for an attacker · ⚠ raises it

Proof of concept

No public PoC is currently catalogued.

Search for new PoCs

Search GitHub now — results may be empty or unverified.

Tracked sources are checked daily for recent CVEs, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.

Data snapshot:

Affected

Vendors Gomarkdown

Products Markdown

Weakness (CWE)

  • CWE-125: : Out-of-bounds Read

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References and research data (JSON)

Packages and version ranges

Each advisory describes its own package and affected ranges. A boundary applies to that range; it is not a universal upgrade recommendation.

  • github.com/gomarkdown/markdown Go

    pkg:golang/github.com/gomarkdown/markdown

    SEMVER range
    • All earlier versions (introduced 0)
    • Fixed boundary (excluded): 0.0.0-20260724235538-61af6e1e6971
    Additional upstream package constraints
    {
  "database": {
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-cv23-7vc5-jfh7/GHSA-cv23-7vc5-jfh7.json"
  }
}
    GitHub Advisory Database · GHSA-cv23-7vc5-jfh7 · Updated 2026-10-16T16:00:45.389675499Z

Vendor product assessments

  • ansible-automation-platform/automation-orchestrator-temporal-rhel9 as a component of Ansible Automation Orchestrator 2026 · known affected

    Vendor assessment for this product only.

    pkg:oci/automation-orchestrator-temporal-rhel9@sha256:2fe8caaa4e27e70b4edb12e8d57e60e326a74d82c14d84cebf557026773500c8?repository_url=registry.redhat.io/ansible-automation-platform/automation-orchestrator-temporal-rhel9

    • workaround: There is no mitigation for this issue. Affected components should update their github.com/gomarkdown/markdown dependency to a release that includes the upstream fix (commit 61af6e1e6971 or later), which validates URL length before it is sliced in parser.IsSafeURL. --- CME Mitigation Guidance (2026-10-20) --- Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure. The highest-value action is to validate URL length before slicing in URL sanitization routines or avoid exposing html.Safelink rendering to untrusted Markdown: upgrade to github.com/gomarkdown/markdown 0.0.0-20260724235538-61af6e1e6971 (or the fixed Golang Github Gomarkdown Markdown/Matterbridge/Multicluster Globalhub/Multicluster Globalhub Grafana Rhel/Rhacm2/Acm Grafana Rhel/Ansible Automation Platform/Automation Orchestrator Temporal Rhel builds), which validate that the URL length is at least the prefix length before slicing url[:nPath], skipping comparisons when the URL is shorter, closing all 3 injection vectors (crafted Markdown link with empty destination, crafted Markdown link with short relative destination like dot or double dot, direct submission of short URL strings to parser.IsSafeURL). Until patched, this is a concern on applications parsing untrusted Markdown using markdown.ToHTML with html.Safelink enabled, or directly calling parser.IsSafeURL on untrusted input, so avoid parsing untrusted Markdown with html.Safelink enabled and avoid passing unvalidated attacker-controlled URL strings directly to parser.IsSafeURL. These controls limit blast radius and contain exploitation, but they do not fix the underlying slice-bounds out-of-range panic defect — apply the upstream patch to fully remediate. Highest-impact CME: CME-1311 Input Size and Quantity Bounds Enforcement (high)
    • none available: Affected
    Red Hat · CVE-2026-102941 · Updated 2026-10-21T07:59:43+00:00
  • multicluster-globalhub/multicluster-globalhub-grafana-rhel9 as a component of Multicluster Global Hub · known affected

    Vendor assessment for this product only.

    pkg:oci/multicluster-globalhub-grafana-rhel9@sha256:3d51e8050687b6a4b399c5b04f04611ae60f13d3c0487cf5bc29506141ce3e45?repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9

    • workaround: There is no mitigation for this issue. Affected components should update their github.com/gomarkdown/markdown dependency to a release that includes the upstream fix (commit 61af6e1e6971 or later), which validates URL length before it is sliced in parser.IsSafeURL. --- CME Mitigation Guidance (2026-10-20) --- Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure. The highest-value action is to validate URL length before slicing in URL sanitization routines or avoid exposing html.Safelink rendering to untrusted Markdown: upgrade to github.com/gomarkdown/markdown 0.0.0-20260724235538-61af6e1e6971 (or the fixed Golang Github Gomarkdown Markdown/Matterbridge/Multicluster Globalhub/Multicluster Globalhub Grafana Rhel/Rhacm2/Acm Grafana Rhel/Ansible Automation Platform/Automation Orchestrator Temporal Rhel builds), which validate that the URL length is at least the prefix length before slicing url[:nPath], skipping comparisons when the URL is shorter, closing all 3 injection vectors (crafted Markdown link with empty destination, crafted Markdown link with short relative destination like dot or double dot, direct submission of short URL strings to parser.IsSafeURL). Until patched, this is a concern on applications parsing untrusted Markdown using markdown.ToHTML with html.Safelink enabled, or directly calling parser.IsSafeURL on untrusted input, so avoid parsing untrusted Markdown with html.Safelink enabled and avoid passing unvalidated attacker-controlled URL strings directly to parser.IsSafeURL. These controls limit blast radius and contain exploitation, but they do not fix the underlying slice-bounds out-of-range panic defect — apply the upstream patch to fully remediate. Highest-impact CME: CME-1311 Input Size and Quantity Bounds Enforcement (high)
    • no fix planned: Will not fix
    Red Hat · CVE-2026-102941 · Updated 2026-10-21T07:59:43+00:00
  • rhacm2/acm-grafana-rhel9 as a component of Red Hat Advanced Cluster Management for Kubernetes 2 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/acm-grafana-rhel9@sha256:aa7ca316ec068e466c4a413b83b3f24a26653dc2c63497a5f6f48a8cc44c36c7?repository_url=registry.redhat.io/rhacm2/acm-grafana-rhel9

    Red Hat · CVE-2026-102941 · Updated 2026-10-21T07:59:43+00:00
  • cri-o as a component of Red Hat OpenShift Container Platform 4 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/cri-o

    Red Hat · CVE-2026-102941 · Updated 2026-10-21T07:59:43+00:00
  • cri-o.src as a component of Red Hat OpenShift Container Platform 4 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/cri-o?arch=src

    Red Hat · CVE-2026-102941 · Updated 2026-10-21T07:59:43+00:00
  • openshift4/kube-metrics-server-rhel8 as a component of Red Hat OpenShift Container Platform 4 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/kube-metrics-server-rhel8@sha256:43528a5404c7021147f1b5419dba92b98019e367f76186873f2f21e8e1f63720?repository_url=registry.redhat.io/openshift4/kube-metrics-server-rhel8

    Red Hat · CVE-2026-102941 · Updated 2026-10-21T07:59:43+00:00
  • openshift4/kube-metrics-server-rhel9 as a component of Red Hat OpenShift Container Platform 4 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/kube-metrics-server-rhel9@sha256:d5b36a18f900569574967517a2a5d9e5f2a553cc69988f969ac03755e3d5809a?repository_url=registry.redhat.io/openshift4/kube-metrics-server-rhel9

    Red Hat · CVE-2026-102941 · Updated 2026-10-21T07:59:43+00:00

All CVSS metrics

  • HIGH 7.5 v3.1 · CNA Primary
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  • HIGH 7.5 v3.1 · NVD Secondary
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

Advisories

Technical & other

Sources: NVD · CVE.org · EPSS