markdown-it is a popular Markdown parser. Versions 14.1.1 and earlier contain a denial‑of‑service weakness when the typographer option is enabled. The smartquotes rule uses replaceAt() to insert quotes, performing O(n) operations per quote. When many quote characters appear, the overall complexity grows quadratically, starving the process of CPU and allowing an attacker to exhaust resources by submitting quote‑heavy Markdown. This can degrade or disrupt the service that hosts or renders the Markdown.

The affected product is markdown‑it by markdown‑it, specifically all releases at 14.1.1 or earlier. The vulnerability is present only when typographer:true is activated, a setting that is off by default but is often enabled in production systems for better typographic output. The fix is available in 14.2.0 and later releases.

The CVSS score is 5.3, indicating moderate severity. The EPSS score is below 1 % and the issue is not on the CISA KEV list, implying it is unlikely to see widespread exploitation. Nevertheless, the attack can be carried out by providing malicious Markdown input containing many “smart‑quote” characters to a vulnerable parser. Because the issue relies on CPU consumption, the impact is limited to availability and does not expose confidentiality or integrity.