Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
gjtorikian/commonmarker
main @ 517a4c0
2
Fixes
1
CVEs
CRITICAL
Peak severity
Highlights
Auth Bypass: 1 prior fix. Scrutinize any change in this area.
ext/commonmarker/commonmarker.c: most-fixed (1 issue). Treat as high-risk during review.
2 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Use After Free: Inadequate tracking of C node lifetimes relative to the Ruby GC leads to use-after-free and double-free conditions during node hierarchy manipulation. Developers must ensure any custom C wrappers properly implement GC mark functions to track parent-child relationships and update finalizers dynamically.
Auth Bypass: Render-time safety policies can be completely bypassed if option flags such as :SAFE and :tagfilter are ignored or dropped during custom element rendering, resulting in cross-site scripting (XSS). Custom rendering pipelines must robustly propagate and enforce these option checks before emitting raw node content.
Integer Overflow: Parsing tables containing massive column counts (exceeding UINT16_MAX) triggers an integer overflow leading to heap corruption. Input sanitization or strict column limits are required during parser initialization.