The vulnerability arises in markdown‑it when the html option or CommonMark preset is active. Input containing repeated unterminated inline HTML comments, processing instructions, declarations, or CDATA sections within a paragraph triggers a quadratic‑time search for a closing tag in src/rules_inline/html_inline.ts. The parser repeatedly rescans overlapping input, consuming disproportionate CPU and blocking the event loop. The outcome is a denial of service that affects the availability of any application that renders user‑supplied Markdown into HTML. The weakness is a predictable denial‑of‑service (CWE‑1333), uncontrolled resource consumption (CWE‑400), and excessive processing complexity (CWE‑407).

All installations of markdown‑it before 14.3.3 and 15.0.3 are vulnerable when inline HTML parsing is enabled. The fix is available in releases 14.3.3 and 15.0.3. Products that include markdown‑it as a dependency, such as static site generators, blogging platforms, or content‑management systems, must identify the version and confirm whether the html option or CommonMark preset is turned on.

The CVSS score of 3.7 represents low overall severity, but the denial of service can be triggered with a single crafted Markdown payload. The EPSS score is currently unavailable and the issue is not listed in CISA KEV. Based on the description, an attacker would need the ability to supply Markdown to the application, such as through a web API endpoint, an editor, or any interface that accepts user‑generated Markdown. The exploit will consume CPU resources and block the event loop, causing the application or browser to become unresponsive. Because no privileged code execution is required, the risk to confidentiality or integrity is negligible, but the impact on availability can be significant in high‑traffic environments.