{"id":"RUSTSEC-2026-0433","summary":"Quadratic parsing of nested image wikilinks with `ENABLE_WIKILINKS`","details":"With `Options::ENABLE_WIKILINKS`, handle_wikilink builds a wikilink's target\nfrom the raw text of its body: scan_wikilink_pipe walks it looking for |, then\ncontains('\\0') and from_replace_nuls walk it again.\nOnce a wikilink is created, disable_all_links only disables Link entries, so\nevery enclosing `![[` stays live on the wikilink stack.\nOn `![[![[![[…]]]]]]` each of those openers then resolves in turn and rescans\neverything inside it, which is quadratic in the nesting depth.\nThe event count stays tiny, because in the unpiped case each enclosing image\nreplaces its body with a fresh text node, so all of that work is thrown away.\n\nApplications that parse untrusted Markdown with `ENABLE_WIKILINKS` set,\nincluding through `Options::all()`, are affected. The option is off by default.\nParsing without it is not affected.\n\nThe flaw was fixed in\n[#1186](https://github.com/pulldown-cmark/pulldown-cmark/pull/1186) and\nreleased in 0.13.6.","modified":"2026-11-02T11:30:18.315201167Z","published":"2026-10-28T12:00:00Z","database_specific":{"license":"CC0-1.0"},"references":[{"type":"PACKAGE","url":"https://crates.io/crates/pulldown-cmark"},{"type":"ADVISORY","url":"https://rustsec.org/advisories/RUSTSEC-2026-0433.html"},{"type":"WEB","url":"https://github.com/pulldown-cmark/pulldown-cmark/pull/1186"},{"type":"WEB","url":"https://github.com/pulldown-cmark/pulldown-cmark/pull/1186"}],"affected":[{"package":{"name":"pulldown-cmark","ecosystem":"crates.io","purl":"pkg:cargo/pulldown-cmark"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.13.0"},{"fixed":"0.13.6"}]}],"ecosystem_specific":{"affects":{"arch":[],"os":[],"functions":[]},"affected_functions":null},"database_specific":{"categories":["denial-of-service"],"cvss":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","informational":null,"source":"https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0433.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}