AIKIDO-2026-190943
comrak is vulnerable to Denial of Service (DoS)
65
Medium Risk
This Affects:
comrakTL;DR
comrak's GFM autolinks extension recurses once per email autolink and rescans the whole URL for each trailing delimiter. Untrusted Markdown with many consecutive email addresses exhausts the thread stack, and a URL followed by many trailing parentheses causes O(n^2) scanning, so small inputs crash or hang the process that parses the Markdown. The fix iterates email autolinking instead of recursing and tracks delimiter counts so parenthesis stripping runs in linear time.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you parse untrusted Markdown with the autolink extension enabled (part of the gfm option set).
Background info
comrak is vulnerable to Denial of Service (DoS) in versions 0.1.0 - 0.54.0.
How to fix this
Upgrade the comrak library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.