RUSTSEC-2026-0433
Quadratic parsing of nested image wikilinks with `ENABLE_WIKILINKS`
With Options::ENABLE_WIKILINKS, handle_wikilink builds a wikilink's target
from the raw text of its body: scan_wikilink_pipe walks it looking for |, then
contains('\0') and from_replace_nuls walk it again.
Once a wikilink is created, disable_all_links only disables Link entries, so
every enclosing ![[ stays live on the wikilink stack.
On ![[![[![[…]]]]]] each of those openers then resolves in turn and rescans
everything inside it, which is quadratic in the nesting depth.
The event count stays tiny, because in the unpiped case each enclosing image
replaces its body with a fresh text node, so all of that work is thrown away.
Applications that parse untrusted Markdown with ENABLE_WIKILINKS set,
including through Options::all(), are affected. The option is off by default.
Parsing without it is not affected.
The flaw was fixed in #1186 and released in 0.13.6.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
What each source reports
OSV Score used
Quadratic parsing of nested image wikilinks with `ENABLE_WIKILINKS`
With Options::ENABLE_WIKILINKS, handle_wikilink builds a wikilink's target
from the raw text of its body: scan_wikilink_pipe walks it looking for |, then
contains('\0') and from_replace_nuls walk it again.
Once a wikilink is created, disable_all_links only disables Link entries, so
every enclosing ![[ stays live on the wikilink stack.
On ![[![[![[…]]]]]] each of those openers then resolves in turn and rescans
everything inside it, which is quadratic in the nesting depth.
The event count stays tiny, because in the unpiped case each enclosing image
replaces its body with a fresh text node, so all of that work is thrown away.
Applications that parse untrusted Markdown with ENABLE_WIKILINKS set,
including through Options::all(), are affected. The option is off by default.
Parsing without it is not affected.
The flaw was fixed in #1186 and released in 0.13.6.
- Record
RUSTSEC-2026-0433- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
pulldown-cmarkcrates.io |
0.13.0 up to 0.13.6 | 0.13.6 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
RUSTSEC-2026-0433 is a high vulnerability (CVSS 7.5) in pulldown-cmark, published October 28, 2026. No source lists public exploit code. Fixed in pulldown-cmark 0.13.6.