Key points
- The vulnerability affects versions prior to 0.0.0-20260724235538-61af6e1e6971.
- A high-severity rating was assigned to CVE-2026-102941 by GitHub.
- The flaw causes an unrecoverable crash when processing empty or short URLs.
Small-business owners using the Go programming language should update the github.com/gomarkdown/markdown package immediately. The vendor released a patch in version 0.0.0-20260724235538-61af6e1e6971 to address a high-severity flaw. This update resolves a crash that occurs when the software processes specific types of user input.
In plain English
The issue stems from how the library checks if a web address is safe. The code attempts to read the first few characters of a link before verifying that the link is long enough to contain them. If a user provides an empty link or one with only one or two characters, the software tries to read data that does not exist. This triggers a panic, which is an abrupt and unrecoverable crash.
The background
According to GitHub advisory GHSA-cv23-7vc5-jfh7, this defect has existed since 2022. It affects the IsSafeURL function within the parser. The crash happens specifically when the html.Safelink hardening flag is enabled. This flag is designed to sanitize URLs, but the bug causes it to fail catastrophically on short inputs. Services rendering untrusted Markdown are most at risk.
What changes now
The vendor has confirmed that version 0.0.0-20260724235538-61af6e1e6971 fixes the problem. Users must upgrade to this specific commit hash or later to avoid the crash. The fix corrects the order of operations in the code so that length checks happen before the software attempts to slice the URL string. This prevents the slice-bounds panic entirely.
Who needs to act first
Teams should prioritize updating any public-facing websites that allow users to submit Markdown content. Systems running the html.Safelink flag are the most exposed and require immediate attention. Before applying the update, administrators should back up their current configuration and test the new version in a staging environment. This ensures the fix does not break existing layouts or features.
What to do and how to stay safe: Go
- Check your dependency management tool to see if you are using a vulnerable version of the gomarkdown package.
- Review your application logs for recent panic errors related to slice bounds or URL parsing failures.
- Update the library to the patched version once the vendor provides an update.
- Monitor your servers for stability after the update to ensure the crash no longer occurs.
Step-by-step guide: Out-of-Band Patches: Meaning, Risks, and Deployment Reality
General security guidance from the Patch Herald newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVE ID for this vulnerability?
The vulnerability is tracked as CVE-2026-102941.
Which versions of the package are affected?
All versions prior to 0.0.0-20260724235538-61af6e1e6971 are vulnerable.
Does this require user interaction to exploit?
Yes, it requires a user to submit an empty or very short link in Markdown.
