{"id":"CVE-2024-1899","aliases":["EUVD-2024-17621","GHSA-rmmh-p597-ppvv","ROOT-APP-NPM-CVE-2024-1899"],"status":"published","title":"Showdownjs Denial of Service","description":"An issue in the anchors subparser of Showdownjs versions \u003c= 2.1.0 could allow a remote attacker to cause denial of service conditions.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00806,"percentile":0.57064,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-674","CWE-777"],"published":"2024-02-26T18:45:23Z","modified":"2026-10-28T02:30:38Z","fixes":[{"ecosystem":"Root:npm","package":"@rootio/showdown","fixed_in":["2.1.0-root.io.1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"showdown","fixed_in":["2.1.0-aikido.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"showdown","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.1.0"}]}]},{"source":"osv","ecosystem":"npm","package":"showdown","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"last_affected":"2.1.0"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/showdown","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-root.io.1"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"showdown","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-aikido.1"}]}]}],"products":[{"vendor":"showdownjs","product":"showdown"}],"references":[{"url":"https://www.tenable.com/security/research/tra-2024-05","tags":["x_transferred","Exploit","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-1899","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-rmmh-p597-ppvv"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/1xxx/CVE-2024-1899.json","tags":["advisory"]},{"url":"https://github.com/showdownjs/showdown","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2024-1899","title":"Showdownjs Denial of Service","description":"An issue in the anchors subparser of Showdownjs versions \u003c= 2.1.0 could allow a remote attacker to cause denial of service conditions.\n","status":"published","published":"2024-02-26T18:45:23.289Z","modified":"2024-08-01T18:56:22.277Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-674"],"updated_at":"2026-11-02T14:34:18.259965Z"}],"euvd":[{"id":"EUVD-2024-17621","description":"An issue in the anchors subparser of Showdownjs versions \u003c= 2.1.0 could allow a remote attacker to cause denial of service conditions.\n","status":"published","published":"2024-02-26T18:45:23Z","modified":"2024-08-01T18:56:22Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-03T03:50:40.972877Z"}],"ghsa":[{"id":"GHSA-rmmh-p597-ppvv","title":"Showdown vulnerable to Regular Expression Denial of Service (ReDoS) in link/anchor parsing","description":"Showdownjs, versions \u003c= 2.1.0, `anchors` subparser used to parse links has a nested regular expression which can lead to denial of service conditions given malicious input.","status":"published","published":"2024-02-26T21:31:36Z","modified":"2026-04-24T20:36:03Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-674","CWE-777"],"updated_at":"2026-11-02T14:39:56.453138Z"}],"nvd":[{"id":"CVE-2024-1899","description":"An issue in the anchors subparser of Showdownjs versions \u003c= 2.1.0 could allow a remote attacker to cause denial of service conditions.\n","status":"published","published":"2024-02-26T19:15:07.037Z","modified":"2026-06-17T07:05:14.907Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-674"],"updated_at":"2026-11-02T14:09:38.473056Z"}],"osv":[{"id":"CVE-2024-1899","title":"Showdownjs Denial of Service","description":"An issue in the anchors subparser of Showdownjs versions \u003c= 2.1.0 could allow a remote attacker to cause denial of service conditions.\n","status":"published","published":"2024-02-26T18:45:23.289Z","modified":"2026-10-28T02:30:38.857579391Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:44:37.917085Z"},{"id":"GHSA-rmmh-p597-ppvv","title":"Showdown vulnerable to Regular Expression Denial of Service (ReDoS) in link/anchor parsing","description":"Showdownjs, versions \u003c= 2.1.0, `anchors` subparser used to parse links has a nested regular expression which can lead to denial of service conditions given malicious input.","status":"published","published":"2024-02-26T21:31:36Z","modified":"2026-09-10T03:50:09.886621379Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-674","CWE-777"],"updated_at":"2026-11-02T15:46:56.281047Z"},{"id":"ROOT-APP-NPM-CVE-2024-1899","title":"CVE-2024-1899 in @rootio/showdown - Patched by Root","description":"Root has patched CVE-2024-1899 in the @rootio/showdown package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-06-24T06:22:15Z","modified":"2026-06-24T14:03:32.298248626Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:27.362922Z"}]}}