AIKIDO-2026-10249

TL;DR

Affected versions of this package are vulnerable to a regular expression denial of service (ReDoS) vulnerability caused by inefficient regex patterns used during Markdown parsing. Specially crafted input containing malformed emphasis markers or similar adversarial sequences can trigger catastrophic backtracking, leading to excessive CPU or memory consumption and potentially causing the application to hang or become unavailable. The issue is fixed by updating regex patterns throughout the parser to use possessive quantifiers, preventing backtracking and eliminating the denial-of-service condition.