CVE-2020-26307

HighCVSS 8.7/10Last modified Jun 17, 2026

Description

HTML2Markdown is a Javascript implementation for converting HTML to Markdown text. All available versions contain one or more regular expressions that are vulnerable to Regular Expression Denial of Service (ReDoS). As of time of publication, no known patches are available.

Metrics

CVSS 4.0 8.7/10CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Green

Weakness enumeration

CWE-1333

Affected software

VendorProductVersions
kateshtml2markdown<= 1.0.2
kateshtml2markdown<= 1.0.2

References

Timeline

Published
Oct 26, 2024
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2020

CVE-2020-263087.5Validate.js provides a declarative way of validating javascript objects. Versions 0.13.1 and prior contain one or more regular expressions tCVE-2020-263098.7Validate.js provides a declarative way of validating javascript objects. Versions 0.11.3 and prior contain one or more regular expressions tCVE-2020-26316.0Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Application Service Level Mgmt). SuppCVE-2020-263108.7Validate.js provides a declarative way of validating javascript objects. All versions as of 30 November 2020 contain one or more regular expCVE-2020-263117.5Useragent is a user agent parser for Node.js. All versions as of time of publication contain one or more regular expressions that are vulnerCVE-2020-263128.1Dotmesh is a git-like command-line interface for capturing, organizing and sharing application states. In versions 0.8.1 and prior, the unsaCVE-2020-26326.0Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: System Monitoring). Supported versionCVE-2020-26336.0Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Connector Framework). Supported versiCVE-2020-26346.0Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Configuration Standard Framewk). SuppCVE-2020-26356.0Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: System Monitoring). Supported versionCVE-2020-26366.0Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Application Service Level Mgmt). SuppCVE-2020-26376.0Vulnerability in the Enterprise Manager for Oracle Database product of Oracle Enterprise Manager (component: Change Manager - web based). Su
CVE-2020-26307: High severity, CVSS 8.7 | Vulnix