Go markdown library slice panic causes crash with Safelink flag

The github.com/gomarkdown/markdown library contains a high-severity flaw that causes a slice-bounds panic when processing specific markdown inputs. This defect impacts any service that renders untrusted markdown while using the html.Safelink hardening flag. The issue stems from improper length validation before memory slicing operations in the parser.

Root cause

The vulnerability exists in the IsSafeURL function within parser.go. The code attempts to slice the URL byte slice before verifying that the slice length exceeds the path prefix length. This ordering error means that if the input URL is shorter than the path being checked, the operation triggers a runtime panic.

Attack path

An attacker can trigger this crash by submitting markdown with an empty or very short link destination. For example, input like [x]() or [x](.) will cause the parser to panic when the Safelink flag is active. The crash occurs because the code tries to access bytes that do not exist in the short input string.

Affected versions

• Versions prior to 0.0.0-20260724235538-61af6e1e6971 are vulnerable to this slice-bounds panic.
• The patch was released in version 0.0.0-20260724235538-61af6e1e6971 and fixes the ordering issue.
• The flaw has been present in the codebase since 2022, affecting many deployments of the library.

Mitigation

• Update the github.com/gomarkdown/markdown dependency to version 0.0.0-20260724235538-61af6e1e6971 or later.
• Disable the html.Safelink flag if an immediate update is not possible, though this reduces security.
• Implement input validation at the application layer to reject markdown with extremely short link destinations.

Signals worth monitoring

Teams usually detect this type of crash through application logs showing slice-bounds panic errors. Security operations should monitor for sudden goroutine failures in markdown rendering services. Check whether error rates spike when users submit links with minimal characters. Look for patterns where specific short strings trigger immediate service unavailability. Contain the issue by isolating affected rendering endpoints. Verify that logging captures the full panic stack trace. Ensure that monitoring alerts trigger on unhandled runtime panics in critical parsing functions.

What to do and how to stay safe: go

• Review your dependency tree for older versions of the gomarkdown library and update them immediately.
• Configure your application to catch and log panics from the markdown parser to prevent full service crashes.
• Test your markdown rendering pipeline with empty and single-character link destinations to verify resilience.
• Monitor server logs for slice-bounds errors that indicate exploitation of this specific parsing logic flaw.

Step-by-step guide: Attack Surface Management: 6 Common Misreadings and Correct Views

General security guidance from the NetSec Observer newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the severity of CVE-2026-102941?

GitHub rates this vulnerability as high severity due to the potential for denial of service through application crashes.

Does the bug require the Safelink flag to be triggered?

The end-to-end crash requires the html.Safelink flag, but direct calls to the IsSafeURL function can panic without it.

Is there a fix available for this vulnerability?

Yes, the issue is patched in version 0.0.0-20260724235538-61af6e1e6971 of the github.com/gomarkdown/markdown library.