CVE-2026-40890

Name of the Vulnerable Software and Affected Versions github.com/gomarkdown/markdown (affected versions not specified)

Description Processing malformed input containing a < character that is not followed by a > character anywhere in the remaining text using a SmartypantsRenderer can lead to an Out of Bounds read or a panic. This occurs because the smartLeftAngle() function performs an out-of-bounds slice operation. If the slice length is lower than its capacity, an extra byte of data is read; if the length equals the capacity, it results in a panic, potentially leading to a Denial of Service on the processing service.

Recommendations Apply the fix provided in commit 759bbc3e32073c3bc4e25969c132fc520eda2778.