CVE-2019-25103

Published: Feb 12, 2023Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

A vulnerability has been found in simple-markdown 0.5.1 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file simple-markdown.js. The manipulation leads to inefficient regular expression complexity. The attack can be launched remotely. Upgrading to version 0.5.2 is able to address this issue. The patch is named 89797fef9abb4cab2fb76a335968266a92588816. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-220639.

Affected (1)

Products: Khanacademy: Simple Markdown

1 product

Simple Markdown

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Khanacademy Simple Markdown	Version 0.5.1

Related CWEs

Inefficient Regular Expression Complexity

The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.

References (8)

https://github.com/ariabuckles/simple-markdown/commit/89797fef9abb4cab2fb76a335968266a92588816

Source: cna@vuldb.com

Patch

https://github.com/ariabuckles/simple-markdown/releases/tag/0.5.2

Source: cna@vuldb.com

Release Notes

https://vuldb.com/?ctiid.220639

Source: cna@vuldb.com

Third Party Advisory

https://vuldb.com/?id.220639

Source: cna@vuldb.com

Third Party Advisory

https://github.com/ariabuckles/simple-markdown/commit/89797fef9abb4cab2fb76a335968266a92588816

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

https://github.com/ariabuckles/simple-markdown/releases/tag/0.5.2

Source: af854a3a-2127-422b-91ae-364da2661108

Release Notes

https://vuldb.com/?ctiid.220639

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://vuldb.com/?id.220639

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.