{"cve":"CVE-2023-28631","nvd":{"published":"2023-03-28T21:15:11.250","modified":"2026-06-17T05:48:25.880","status":"Modified","description":"comrak is a CommonMark + GFM compatible Markdown parser and renderer written in rust. A Comrak AST can be constructed manually by a program instead of parsing a Markdown document with `parse_document`. This AST can then be converted to HTML via `html::format_document_with_plugins`. However, the HTML formatting code assumes that the AST is well-formed. For example, many AST notes contain `[u8]` fields which the formatting code assumes is valid UTF-8 data. Several bugs can be triggered if this is not the case. Version 0.17.0 contains adjustments to the AST, storing strings instead of unvalidated byte arrays. Users are advised to upgrade. Users unable to upgrade may manually validate UTF-8 correctness of all data when assigning to `&[u8]` and `Vec<u8>` fields in the AST. This issue is also tracked as `GHSL-2023-049`.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8},"cwes":["CWE-755"],"references":["https://github.com/kivikakk/comrak/commit/9ff5f8df0ac951f5742d22a72c39b89a15f56639","https://github.com/kivikakk/comrak/security/advisories/GHSA-5r3x-p7xx-x6q5","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OUYME2VA555X6567H7ORIJQFN4BVGT6N/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PTWZWCT7KCX2KTXTLPUYZ3EHOONG4X46/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VQ3UBC7LE4VPCMZBTADIBL353CH7CPVV/"],"products":["comrak_project:comrak"],"source":"nvd","synced_at":"2026-10-19T21:37:48.383111019+00:00"},"epss":{"cve":"CVE-2023-28631","score":0.01268,"percentile":0.69782,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-5r3x-p7xx-x6q5","url":"https://osv.dev/vulnerability/GHSA-5r3x-p7xx-x6q5","summary":"Comrak AST node data is not validated (GHSL-2023-049)","modified":"2026-09-10T03:49:52.639385252Z","packages":[{"ecosystem":"crates.io","name":"comrak","purl":"pkg:cargo/comrak","ranges":["<0.17.0"],"fixed":["0.17.0"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}