[renovate]

This PR contains the following updates:

Package	Type	Update	Change
pulldown-cmark	workspace.dependencies	patch	0.13.5 → 0.13.6

---

Quadratic parsing of nested image wikilinks with ENABLE_WIKILINKS

RUSTSEC-2026-0433

More information

Details

With Options::ENABLE_WIKILINKS, handle_wikilink builds a wikilink's target
from the raw text of its body: scan_wikilink_pipe walks it looking for |, then
contains('\0') and from_replace_nuls walk it again.
Once a wikilink is created, disable_all_links only disables Link entries, so
every enclosing ![[ stays live on the wikilink stack.
On ![[![[![[…]]]]]] each of those openers then resolves in turn and rescans
everything inside it, which is quadratic in the nesting depth.
The event count stays tiny, because in the unpiped case each enclosing image
replaces its body with a fresh text node, so all of that work is thrown away.

Applications that parse untrusted Markdown with ENABLE_WIKILINKS set,
including through Options::all(), are affected. The option is off by default.
Parsing without it is not affected.

The flaw was fixed in
#​1186 and
released in 0.13.6.

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

• https://crates.io/crates/pulldown-cmark
• https://rustsec.org/advisories/RUSTSEC-2026-0433.html
• https://github.com/pulldown-cmark/pulldown-cmark/pull/1186
• https://github.com/pulldown-cmark/pulldown-cmark/pull/1186

This data is provided by OSV and the Rust Advisory Database (CC0 1.0).

---

Release Notes

raphlinus/pulldown-cmark (pulldown-cmark)

v0.13.6: Fix quadratic parsing of nested image wikilinks

Compare Source

This version backports #​1186 to fix quadratic parsing of nested image wikilinks.

Full Changelog: pulldown-cmark/pulldown-cmark@v0.13.5...v0.13.6

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[codspeed]

Merging this PR will not alter performance

✅ 2 untouched benchmarks
⏩ 11 skipped benchmarks¹

---

_{Comparing renovate/crate-pulldown-cmark-vulnerability (80ac152) with main (5f48f9b)}

Footnotes

1. 11 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩