What is GHSA-rmmh-p597-ppvv?

GHSA-rmmh-p597-ppvv is a security advisory published by GitHub Security Advisories with Medium severity. Showdown vulnerable to Regular Expression Denial of Service (ReDoS) in link/anchor parsing

Which CVE IDs does GHSA-rmmh-p597-ppvv cover?

GHSA-rmmh-p597-ppvv covers the following CVE IDs: CVE-2024-1899. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-rmmh-p597-ppvv?

GHSA-rmmh-p597-ppvv has a CVSS v3 base score of 5.3, published by GitHub Security Advisories.

Which products are affected by GHSA-rmmh-p597-ppvv?

GHSA-rmmh-p597-ppvv affects 1 product, including: npm/showdown:\u003c= 2.1.0.

GHSA-rmmh-p597-ppvvMediumCVSS 5.3

Showdown vulnerable to Regular Expression Denial of Service (ReDoS) in link/anchor parsing

Vendor

GitHub Security Advisories

Published

February 26, 2024

Last Modified

April 24, 2026

🔗 CVE IDs covered (1)

CVE-2024-1899 →

📋 Description

Showdownjs, versions <= 2.1.0, anchors subparser used to parse links has a nested regular expression which can lead to denial of service conditions given malicious input.

🎯 Affected products1

npm/showdown:<= 2.1.0

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2024-1899
https://www.tenable.com/security/research/tra-2024-05
https://github.com/advisories/GHSA-rmmh-p597-ppvv