GHSA-77fj-vx54-gvh7: Go Markdown has an Out-of-bounds Read in SmartypantsRenderer

April 14, 2026

Processing a malformed input containing a < character that is not followed by a > character anywhere in the remaining text with a SmartypantsRenderer will lead to Out of Bounds read or a panic.

References

github.com/advisories/GHSA-77fj-vx54-gvh7
github.com/gomarkdown/markdown
github.com/gomarkdown/markdown/commit/759bbc3e32073c3bc4e25969c132fc520eda2778
github.com/gomarkdown/markdown/security/advisories/GHSA-77fj-vx54-gvh7

Code Behaviors & Features

Detect and mitigate GHSA-77fj-vx54-gvh7 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →