{"schema":"vulnpedia.research/1","cve":"CVE-2026-102941","generated":"2026-10-26T13:52:32.101Z","references":[{"url":"https://github.com/gomarkdown/markdown/security/advisories/GHSA-cv23-7vc5-jfh7","tags":["x_refsource_CONFIRM","WEB","vendor-reference"],"source":"mitre","sourceId":"GitHub_M","modified":"2026-10-16T15:38:18.086Z","origins":[{"source":"mitre","sourceId":"GitHub_M","modified":"2026-10-16T15:38:18.086Z","url":"https://github.com/gomarkdown/markdown/security/advisories/GHSA-cv23-7vc5-jfh7"},{"source":"nvd","sourceId":"CVE-2026-102941","modified":"2026-10-16T20:04:29.760","url":"https://github.com/gomarkdown/markdown/security/advisories/GHSA-cv23-7vc5-jfh7"},{"source":"ghsa","sourceId":"GHSA-cv23-7vc5-jfh7","url":"https://github.com/gomarkdown/markdown/security/advisories/GHSA-cv23-7vc5-jfh7"},{"source":"ghsa","sourceId":"GHSA-cv23-7vc5-jfh7","modified":"2026-10-16T16:00:45.389675499Z","url":"https://github.com/gomarkdown/markdown/security/advisories/GHSA-cv23-7vc5-jfh7"},{"source":"redhat","sourceId":"CVE-2026-102941","modified":"2026-10-21T07:59:43+00:00","url":"https://github.com/gomarkdown/markdown/security/advisories/GHSA-cv23-7vc5-jfh7"}]},{"url":"https://github.com/gomarkdown/markdown/commit/61af6e1e69710c5ca13cfbaaaa1bc11bc763a8a9","tags":["x_refsource_MISC","WEB","vendor-reference"],"source":"mitre","sourceId":"GitHub_M","modified":"2026-10-16T15:38:18.086Z","origins":[{"source":"mitre","sourceId":"GitHub_M","modified":"2026-10-16T15:38:18.086Z","url":"https://github.com/gomarkdown/markdown/commit/61af6e1e69710c5ca13cfbaaaa1bc11bc763a8a9"},{"source":"nvd","sourceId":"CVE-2026-102941","modified":"2026-10-16T20:04:29.760","url":"https://github.com/gomarkdown/markdown/commit/61af6e1e69710c5ca13cfbaaaa1bc11bc763a8a9"},{"source":"ghsa","sourceId":"GHSA-cv23-7vc5-jfh7","url":"https://github.com/gomarkdown/markdown/commit/61af6e1e69710c5ca13cfbaaaa1bc11bc763a8a9"},{"source":"ghsa","sourceId":"GHSA-cv23-7vc5-jfh7","modified":"2026-10-16T16:00:45.389675499Z","url":"https://github.com/gomarkdown/markdown/commit/61af6e1e69710c5ca13cfbaaaa1bc11bc763a8a9"},{"source":"redhat","sourceId":"CVE-2026-102941","modified":"2026-10-21T07:59:43+00:00","url":"https://github.com/gomarkdown/markdown/commit/61af6e1e69710c5ca13cfbaaaa1bc11bc763a8a9"}]},{"url":"https://osv.dev/vulnerability/GHSA-cv23-7vc5-jfh7","tags":["ADVISORY"],"source":"ghsa","sourceId":"GHSA-cv23-7vc5-jfh7","modified":"2026-10-16T16:00:45.389675499Z","origins":[{"source":"ghsa","sourceId":"GHSA-cv23-7vc5-jfh7","url":"https://osv.dev/vulnerability/GHSA-cv23-7vc5-jfh7"},{"source":"ghsa","sourceId":"GHSA-cv23-7vc5-jfh7","modified":"2026-10-16T16:00:45.389675499Z","url":"https://osv.dev/vulnerability/GHSA-cv23-7vc5-jfh7"}]},{"url":"https://github.com/gomarkdown/markdown","tags":["PACKAGE"],"source":"ghsa","sourceId":"GHSA-cv23-7vc5-jfh7","modified":"2026-10-16T16:00:45.389675499Z","origins":[{"source":"ghsa","sourceId":"GHSA-cv23-7vc5-jfh7","url":"https://github.com/gomarkdown/markdown"},{"source":"ghsa","sourceId":"GHSA-cv23-7vc5-jfh7","modified":"2026-10-16T16:00:45.389675499Z","url":"https://github.com/gomarkdown/markdown"}]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-102941.json","tags":["vendor-advisory"],"source":"redhat","sourceId":"CVE-2026-102941","modified":"2026-10-21T07:59:43+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-102941","modified":"2026-10-21T07:59:43+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-102941.json"}]},{"url":"https://access.redhat.com/security/cve/CVE-2026-102941","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-102941","modified":"2026-10-21T07:59:43+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-102941","modified":"2026-10-21T07:59:43+00:00","url":"https://access.redhat.com/security/cve/CVE-2026-102941"}]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2554173","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-102941","modified":"2026-10-21T07:59:43+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-102941","modified":"2026-10-21T07:59:43+00:00","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2554173"}]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-102941","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-102941","modified":"2026-10-21T07:59:43+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-102941","modified":"2026-10-21T07:59:43+00:00","url":"https://www.cve.org/CVERecord?id=CVE-2026-102941"}]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102941","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-102941","modified":"2026-10-21T07:59:43+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-102941","modified":"2026-10-21T07:59:43+00:00","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102941"}]},{"source":"euvd","sourceId":"EUVD-2026-102934","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-102934","tags":["ADVISORY"],"origins":[{"source":"euvd","sourceId":"EUVD-2026-102934","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-102934"}]}],"packages":[{"source":"ghsa","sourceId":"GHSA-cv23-7vc5-jfh7","url":"https://osv.dev/vulnerability/GHSA-cv23-7vc5-jfh7","ecosystem":"Go","name":"github.com/gomarkdown/markdown","purl":"pkg:golang/github.com/gomarkdown/markdown","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.0.0-20260724235538-61af6e1e6971"}]}],"databaseSpecific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-cv23-7vc5-jfh7/GHSA-cv23-7vc5-jfh7.json"},"modified":"2026-10-16T16:00:45.389675499Z","origins":[{"source":"ghsa","sourceId":"GHSA-cv23-7vc5-jfh7","modified":"2026-10-16T16:00:45.389675499Z","url":"https://osv.dev/vulnerability/GHSA-cv23-7vc5-jfh7"}]}],"pocCandidates":[],"cataloguedPoc":[],"vendorStatements":[{"source":"redhat","sourceId":"CVE-2026-102941","modified":"2026-10-21T07:59:43+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-102941.json","productId":"ansible_automation_orchestrator_2026:ansible-automation-platform/automation-orchestrator-temporal-rhel9","product":"ansible-automation-platform/automation-orchestrator-temporal-rhel9 as a component of Ansible Automation Orchestrator 2026","status":"known_affected","remediations":[{"category":"workaround","details":"There is no mitigation for this issue. Affected components should update their github.com/gomarkdown/markdown dependency to a release that includes the upstream fix (commit 61af6e1e6971 or later), which validates URL length before it is sliced in parser.IsSafeURL.\n\n--- CME Mitigation Guidance (2026-10-20) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\n\nThe highest-value action is to validate URL length before slicing in URL sanitization routines or avoid exposing html.Safelink rendering to untrusted Markdown: upgrade to github.com/gomarkdown/markdown 0.0.0-20260724235538-61af6e1e6971 (or the fixed Golang Github Gomarkdown Markdown/Matterbridge/Multicluster Globalhub/Multicluster Globalhub Grafana Rhel/Rhacm2/Acm Grafana Rhel/Ansible Automation Platform/Automation Orchestrator Temporal Rhel builds), which validate that the URL length is at least the prefix length before slicing url[:nPath], skipping comparisons when the URL is shorter, closing all 3 injection vectors (crafted Markdown link with empty destination, crafted Markdown link with short relative destination like dot or double dot, direct submission of short URL strings to parser.IsSafeURL). Until patched, this is a concern on applications parsing untrusted Markdown using markdown.ToHTML with html.Safelink enabled, or directly calling parser.IsSafeURL on untrusted input, so avoid parsing untrusted Markdown with html.Safelink enabled and avoid passing unvalidated attacker-controlled URL strings directly to parser.IsSafeURL. These controls limit blast radius and contain exploitation, but they do not fix the underlying slice-bounds out-of-range panic defect — apply the upstream patch to fully remediate.\n\nHighest-impact CME: CME-1311 Input Size and Quantity Bounds Enforcement (high)"},{"category":"none_available","details":"Affected"}],"purl":"pkg:oci/automation-orchestrator-temporal-rhel9@sha256:2fe8caaa4e27e70b4edb12e8d57e60e326a74d82c14d84cebf557026773500c8?repository_url=registry.redhat.io/ansible-automation-platform/automation-orchestrator-temporal-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-102941","modified":"2026-10-21T07:59:43+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-102941.json"}]},{"source":"redhat","sourceId":"CVE-2026-102941","modified":"2026-10-21T07:59:43+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-102941.json","productId":"multicluster_global_hub:multicluster-globalhub/multicluster-globalhub-grafana-rhel9","product":"multicluster-globalhub/multicluster-globalhub-grafana-rhel9 as a component of Multicluster Global Hub","status":"known_affected","remediations":[{"category":"workaround","details":"There is no mitigation for this issue. Affected components should update their github.com/gomarkdown/markdown dependency to a release that includes the upstream fix (commit 61af6e1e6971 or later), which validates URL length before it is sliced in parser.IsSafeURL.\n\n--- CME Mitigation Guidance (2026-10-20) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\n\nThe highest-value action is to validate URL length before slicing in URL sanitization routines or avoid exposing html.Safelink rendering to untrusted Markdown: upgrade to github.com/gomarkdown/markdown 0.0.0-20260724235538-61af6e1e6971 (or the fixed Golang Github Gomarkdown Markdown/Matterbridge/Multicluster Globalhub/Multicluster Globalhub Grafana Rhel/Rhacm2/Acm Grafana Rhel/Ansible Automation Platform/Automation Orchestrator Temporal Rhel builds), which validate that the URL length is at least the prefix length before slicing url[:nPath], skipping comparisons when the URL is shorter, closing all 3 injection vectors (crafted Markdown link with empty destination, crafted Markdown link with short relative destination like dot or double dot, direct submission of short URL strings to parser.IsSafeURL). Until patched, this is a concern on applications parsing untrusted Markdown using markdown.ToHTML with html.Safelink enabled, or directly calling parser.IsSafeURL on untrusted input, so avoid parsing untrusted Markdown with html.Safelink enabled and avoid passing unvalidated attacker-controlled URL strings directly to parser.IsSafeURL. These controls limit blast radius and contain exploitation, but they do not fix the underlying slice-bounds out-of-range panic defect — apply the upstream patch to fully remediate.\n\nHighest-impact CME: CME-1311 Input Size and Quantity Bounds Enforcement (high)"},{"category":"no_fix_planned","details":"Will not fix"}],"purl":"pkg:oci/multicluster-globalhub-grafana-rhel9@sha256:3d51e8050687b6a4b399c5b04f04611ae60f13d3c0487cf5bc29506141ce3e45?repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-102941","modified":"2026-10-21T07:59:43+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-102941.json"}]},{"source":"redhat","sourceId":"CVE-2026-102941","modified":"2026-10-21T07:59:43+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-102941.json","productId":"red_hat_advanced_cluster_management_for_kubernetes_2:rhacm2/acm-grafana-rhel9","product":"rhacm2/acm-grafana-rhel9 as a component of Red Hat Advanced Cluster Management for Kubernetes 2","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:oci/acm-grafana-rhel9@sha256:aa7ca316ec068e466c4a413b83b3f24a26653dc2c63497a5f6f48a8cc44c36c7?repository_url=registry.redhat.io/rhacm2/acm-grafana-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-102941","modified":"2026-10-21T07:59:43+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-102941.json"}]},{"source":"redhat","sourceId":"CVE-2026-102941","modified":"2026-10-21T07:59:43+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-102941.json","productId":"red_hat_openshift_container_platform_4:cri-o","product":"cri-o as a component of Red Hat OpenShift Container Platform 4","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:rpm/redhat/cri-o","origins":[{"source":"redhat","sourceId":"CVE-2026-102941","modified":"2026-10-21T07:59:43+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-102941.json"}]},{"source":"redhat","sourceId":"CVE-2026-102941","modified":"2026-10-21T07:59:43+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-102941.json","productId":"red_hat_openshift_container_platform_4:cri-o.src","product":"cri-o.src as a component of Red Hat OpenShift Container Platform 4","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:rpm/redhat/cri-o?arch=src","origins":[{"source":"redhat","sourceId":"CVE-2026-102941","modified":"2026-10-21T07:59:43+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-102941.json"}]},{"source":"redhat","sourceId":"CVE-2026-102941","modified":"2026-10-21T07:59:43+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-102941.json","productId":"red_hat_openshift_container_platform_4:openshift4/kube-metrics-server-rhel8","product":"openshift4/kube-metrics-server-rhel8 as a component of Red Hat OpenShift Container Platform 4","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:oci/kube-metrics-server-rhel8@sha256:43528a5404c7021147f1b5419dba92b98019e367f76186873f2f21e8e1f63720?repository_url=registry.redhat.io/openshift4/kube-metrics-server-rhel8","origins":[{"source":"redhat","sourceId":"CVE-2026-102941","modified":"2026-10-21T07:59:43+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-102941.json"}]},{"source":"redhat","sourceId":"CVE-2026-102941","modified":"2026-10-21T07:59:43+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-102941.json","productId":"red_hat_openshift_container_platform_4:openshift4/kube-metrics-server-rhel9","product":"openshift4/kube-metrics-server-rhel9 as a component of Red Hat OpenShift Container Platform 4","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:oci/kube-metrics-server-rhel9@sha256:d5b36a18f900569574967517a2a5d9e5f2a553cc69988f969ac03755e3d5809a?repository_url=registry.redhat.io/openshift4/kube-metrics-server-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-102941","modified":"2026-10-21T07:59:43+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-102941.json"}]}],"vendorCoverage":{"total":7,"shown":7,"omitted":0,"source":"redhat"}}