CVE-2025-9670

EUVD-2025-28874
A security flaw has been discovered in mixmark-io turndown up to 7.2.1. This affects an unknown function of the file src/commonmark-rules.js. Performing manipulation results in inefficient regular expression complexity. It is possible to initiate the attack remotely. The exploit has been released to the public and may be exploited.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.3 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 39.63%
Debian logo
Debian Releases
Debian Product
Codename
node-turndown
bookworm
no-dsa
forky
7.2.4+~2.2.0~git20240406-1
fixed
sid
7.2.4+~2.2.0~git20240406-1
fixed
trixie
no-dsa
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
node-turndown
jammy
needs-triage
noble
needs-triage
plucky
ignored
questing
ignored
resolute
needs-triage
Common Weakness Enumeration
References
https://github.com/mixmark-io/turndown/issues/501
https://github.com/mixmark-io/turndown/issues/501#issue-3336342088
https://vuldb.com/?ctiid.321880
https://vuldb.com/?id.321880
https://vuldb.com/?submit.637911