The package `github.com/gomarkdown/markdown` is a Go library for parsing Markdown text and rendering as HTML. Processing a malformed input containing a < character that is not followed by a > character anywhere in the remaining text with a SmartypantsRenderer will lead to Out of Bounds read or a panic. This vulnerability is fixed with commit 759bbc3e32073c3bc4e25969c132fc520eda2778.
References
| Link | Resource |
|---|---|
| https://github.com/gomarkdown/markdown/commit/759bbc3e32073c3bc4e25969c132fc520eda2778 | Patch |
| https://github.com/gomarkdown/markdown/security/advisories/GHSA-77fj-vx54-gvh7 | Exploit Vendor Advisory |
| https://github.com/gomarkdown/markdown/security/advisories/GHSA-77fj-vx54-gvh7 | Exploit Vendor Advisory |
Configurations
History
27 Apr 2026, 15:07
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/gomarkdown/markdown/commit/759bbc3e32073c3bc4e25969c132fc520eda2778 - Patch | |
| References | () https://github.com/gomarkdown/markdown/security/advisories/GHSA-77fj-vx54-gvh7 - Exploit, Vendor Advisory | |
| CPE | cpe:2.3:a:gomarkdown:markdown:*:*:*:*:*:go:*:* | |
| First Time |
Gomarkdown
Gomarkdown markdown |
21 Apr 2026, 21:16
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/gomarkdown/markdown/security/advisories/GHSA-77fj-vx54-gvh7 - |
21 Apr 2026, 20:17
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-04-21 20:17
Updated : 2026-04-27 15:07
NVD link : CVE-2026-40890
Mitre link : CVE-2026-40890
CVE.ORG link : CVE-2026-40890
JSON object : View
Products Affected
gomarkdown
- markdown
CWE
CWE-125
Out-of-bounds Read