CVE-2025-9670CWE-1333CWE-400denial-of-service

CVE-2025-9670

Medium · published August 29, 2025

CVSS v3.1
5.3
EPSS
0%
Percentile
40.5
In the wild
Unconfirmed
What it is

A security flaw has been discovered in mixmark-io turndown up to 7.2.1. This affects an unknown function of the file src/commonmark-rules.js. Performing manipulation results in inefficient regular expression complexity. It is possible to initiate the attack remotely. The exploit has been released to the public and may be exploited.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00480 · 40.5th percentile
Weaknesses
CWE-1333 · Inefficient Regular Expression Complexity; CWE-400 · Uncontrolled Resource Consumption
Published
2025-08-29T23:15Z
References (5)
https://github.com/mixmark-io/turndown/issues/501 · [email protected]https://github.com/mixmark-io/turndown/issues/501#issue-3336342088 · [email protected]https://vuldb.com/?ctiid.321880 · [email protected]https://vuldb.com/?id.321880 · [email protected]https://vuldb.com/?submit.637911 · [email protected]
EPSS history
Timeline
  • 29 AUG 19:02Z
    mixmark-io turndown commonmark-rules.js redos
    cvelistv5