Skip to content
Log inStart free trial

GHSA-5r3x-p7xx-x6q5 CVE-2023-28631

Comrak AST node data is not validated (GHSL-2023-049)

Critical crates.io
Severity
5.3 / 10
Critical · CVSS 3.1
Exploit chance (EPSS)
1.27%
Chance of exploitation in the next 30 days. Higher than 69.78% of scored vulnerabilities.
Known exploited
No
Not in CISA's catalog
Weakness
CWE-755 Improper Handling of Exceptional Conditions
Fix
0.17.0
Upgrade comrak to this version or later

Description

Impact

A Comrak AST can be constructed manually by a program instead of parsing a Markdown document with parse_document. This AST can then be converted to HTML via html::format_document_with_plugins. However, the HTML formatting code assumes that the AST is well-formed. For example, many AST notes contain [u8] fields which the formatting code assumes is valid UTF-8 data. Several bugs can be triggered if this is not the case.

Patches

0.17.0 contains adjustments to the AST, storing strings instead of unvalidated byte arrays.

Workarounds

  • Validate UTF-8 correctness of all data when assigning to &[u8] and Vec<u8> fields in the AST.

References

n/a

Affected versions

crates.io

PackageVulnerableFixed in
comrak
< 0.17.0
0.17.0

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

comrak crates.io → 0.17.0

cargo
cargo update -p comrak --precise 0.17.0

Severity breakdown

CVSS 3.1 5.3

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
Low

Weakness

CWE-755: Improper Handling of Exceptional Conditions

The product does not handle or incorrectly handles an exceptional condition.

References

Advisories

Packages

Other links

Timeline

  1. Published
  2. Last updated by the source
  3. Latest EPSS score
AdvisorySeverityWhy it's related
GHSA-xxmq-4vph-956w
Comrak vulnerable to production of excessive output when parsing Markdown (GHSL-2023-048)
Medium Also affects comrak
GHSA-8hqf-xjwp-p67v
Comrak vulnerable to quadratic runtime issues when parsing Markdown (GHSL-2023-047)
High Also affects comrak
GHSA-6wj2-g87r-pm62
Cross-site Scripting in comrak
Medium Also affects comrak
GHSA-xmr7-v725-2jjr
Cross site scripting in comrak
Medium Also affects comrak
CVE-2026-109619
PHP has various global state that temporarily points into request memory.
Critical Known exploited Same weakness, CWE-755
CVE-2026-109618
PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request.
Critical Known exploited Same weakness, CWE-755
GHSA-85xf-c7hm-whqw
vLLM: Structured-output request errors escape the request boundary and terminate the shared EngineCore — engine-fatal denial of service (3 sites)
Medium Same weakness, CWE-755
GHSA-x5rw-q4pp-hg5g
devalue: stringifyAsync can cause an unhandled rejection despite a caught returned promise
High Same weakness, CWE-755
Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor