rsec-2023-7

{
  "affected": [
    {
      "database_specific": {
        "source": "https://github.com/RConsortium/r-advisory-database/blob/main/vulns/commonmark/RSEC-2023-7.yaml"
      },
      "package": {
        "ecosystem": "CRAN",
        "name": "commonmark",
        "purl": "pkg:cran/commonmark"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.2"
            },
            {
              "fixed": "1.8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.2",
        "0.4",
        "0.5",
        "0.6",
        "0.7",
        "0.8",
        "0.9",
        "1.0",
        "1.1",
        "1.2",
        "1.4",
        "1.5",
        "1.6",
        "1.7"
      ]
    }
  ],
  "details": "cmark-gfm, GitHub's extended CommonMark library, has multiple vulnerabilities. Versions prior to 0.29.0.gfm.6 suffer from a polynomial time complexity issue in the autolink extension, causing denial of service. Also, versions before 0.29.0.gfm.3 and 0.28.3.gfm.21 contain an integer overflow in table row parsing, leading to heap corruption and potential Arbitrary Code Execution. Patches are available in versions 0.29.0.gfm.6, 0.29.0.gfm.3, and 0.28.3.gfm.21. Mitigations include upgrading or disabling affected extensions.",
  "id": "RSEC-2023-7",
  "modified": "2025-05-19T19:43:48.143066Z",
  "published": "2023-10-06T05:00:00.600Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://security-tracker.debian.org/tracker/CVE-2022-39209"
    },
    {
      "type": "WEB",
      "url": "https://security-tracker.debian.org/tracker/CVE-2022-24724"
    },
    {
      "type": "WEB",
      "url": "https://github.com/r-lib/commonmark/pull/18"
    }
  ],
  "schema_version": "1.7.3",
  "summary": "Denial of Service (DoS) and Arbitrary Code Execution (ACE) vulnerabilities",
  "upstream": [
    "CVE-2022-24724",
    "CVE-2022-39209"
  ]
}