VYPR
← All advisories
High severity7.5NVD Advisory· Published Apr 21, 2026· Updated Apr 27, 2026

CVE-2026-40890

CVE-2026-40890

Description

The package github.com/gomarkdown/markdown is a Go library for parsing Markdown text and rendering as HTML. Processing a malformed input containing a < character that is not followed by a > character anywhere in the remaining text with a SmartypantsRenderer will lead to Out of Bounds read or a panic. This vulnerability is fixed with commit 759bbc3e32073c3bc4e25969c132fc520eda2778.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
github.com/gomarkdown/markdownGo
< 0.0.0-20260411013819-759bbc3e32070.0.0-20260411013819-759bbc3e3207

Affected products

2
  • Gomarkdown/Markdown2 versions
    cpe:2.3:a:gomarkdown:markdown:*:*:*:*:*:go:*:*+ 1 more
    • cpe:2.3:a:gomarkdown:markdown:*:*:*:*:*:go:*:*range: <2026-04-10
    • (no CPE)

Patches

1
759bbc3e3207

fix oob read when no > is found

https://github.com/gomarkdown/markdownJules DenardouApr 10, 2026via ghsa
commit
1 file changed · +4 −1
  • html/smartypants.go+4 −1 modified
    @@ -371,7 +371,10 @@ func (r *SPRenderer) smartLeftAngle(out *bytes.Buffer, previousChar byte, text [
 		i++
 	}
 
-	out.Write(text[:i+1])
+	if i == len(text) { // No > found until the end of the text
+		return i
+	}
+	out.Write(text[:i+1]) // include the '>'
 	return i
 }

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

4

News mentions

12