Medium
CodeMirror Markdown Mode markdown.js redos
Type: advisorySources: OSV
A weakness has been identified in CodeMirror up to 5.65.20. Affected is an unknown function of the file mode/markdown/markdown.js of the component Markdown Mode. This manipulation causes inefficient regular expression complexity. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be exploited. Upgrading to version 6.0 is able to address this issue. You should upgrade the affected component. Not all code samples mentioned in the GitHub issue can be found. The repository mentions, that "CodeMirror 6 exists, and is [...] much more actively maintained."
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2025-6493
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 4 Nov 2026, 01:48 UTC · Revision 1
Source evidence
CodeMirror Markdown Mode markdown.js redos
core-osv · Original sourcePublished 22 Jun 2025, 22:00 UTC
A weakness has been identified in CodeMirror up to 5.65.20. Affected is an unknown function of the file mode/markdown/markdown.js of the component Markdown Mode. This manipulation causes inefficient regular expression complexity. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be exploited. Upgrading to version 6.0 is able to address this issue. You should upgrade the affected component. Not all code samples mentioned in the GitHub issue can be found. The repository mentions, that "CodeMirror 6 exists, and is [...] much more actively maintained."
osv:CVE-2025-6493
Complete source record
{
"id": "6bf75292bce320a6054e7ec36c4312a78236d193524377e5bffb400ea52c43aa",
"url": "https://osv.dev/vulnerability/CVE-2025-6493",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CodeMirror Markdown Mode markdown.js redos",
"summary": "A weakness has been identified in CodeMirror up to 5.65.20. Affected is an unknown function of the file mode/markdown/markdown.js of the component Markdown Mode. This manipulation causes inefficient regular expression complexity. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be exploited. Upgrading to version 6.0 is able to address this issue. You should upgrade the affected component. Not all code samples mentioned in the GitHub issue can be found. The repository mentions, that \"CodeMirror 6 exists, and is [...] much more actively maintained.\"",
"evidence": "osv:CVE-2025-6493",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2025-6493",
"aliases": [
"CVE-2025-6493"
],
"metrics": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/codemirror/codemirror5",
"type": "GIT",
"events": [
{
"introduced": "d60fff6750cd4963ebfd83d446d5bd3ad6b083a3"
},
{
"last_affected": "b0c45cf0fbd3dc7cb2016a79fb81c723827f4e31"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "5.65.0"
},
{
"last_affected": "5.65.0"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "5.65.1"
},
{
"last_affected": "5.65.1"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "5.65.2"
},
{
"last_affected": "5.65.2"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "5.65.3"
},
{
"last_affected": "5.65.3"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "5.65.4"
},
{
"last_affected": "5.65.4"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "5.65.5"
},
{
"last_affected": "5.65.5"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "5.65.6"
},
{
"last_affected": "5.65.6"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "5.65.7"
},
{
"last_affected": "5.65.7"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "5.65.8"
},
{
"last_affected": "5.65.8"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "5.65.9"
},
{
"last_affected": "5.65.9"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "5.65.10"
},
{
"last_affected": "5.65.10"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "5.65.11"
},
{
"last_affected": "5.65.11"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "5.65.12"
},
{
"last_affected": "5.65.12"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "5.65.13"
},
{
"last_affected": "5.65.13"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "5.65.14"
},
{
"last_affected": "5.65.14"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "5.65.15"
},
{
"last_affected": "5.65.15"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "5.65.16"
},
{
"last_affected": "5.65.16"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "5.65.17"
},
{
"last_affected": "5.65.17"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "5.65.18"
},
{
"last_affected": "5.65.18"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "5.65.19"
},
{
"last_affected": "5.65.19"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "5.65.20"
},
{
"last_affected": "5.65.20"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "0"
},
{
"last_affected": "5.65.20"
}
],
"source": "DESCRIPTION"
}
]
}
}
],
"versions": [
"5.65.0",
"5.65.1",
"5.65.10",
"5.65.11",
"5.65.12",
"5.65.13",
"5.65.14",
"5.65.15",
"5.65.16",
"5.65.17",
"5.65.18",
"5.65.19",
"5.65.2",
"5.65.20",
"5.65.3",
"5.65.4",
"5.65.5",
"5.65.6",
"5.65.7",
"5.65.8",
"5.65.9"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-6493.json"
}
}
],
"modified": "2026-10-28T02:30:32.526955469Z",
"provider": "osv",
"references": [
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/6xxx/CVE-2025-6493.json",
"https://nvd.nist.gov/vuln/detail/CVE-2025-6493",
"https://vuldb.com/?id.313610",
"https://vuldb.com/?submit.598875",
"https://github.com/codemirror/codemirror5/issues/7128",
"https://vuldb.com/?ctiid.313610"
],
"provider_metadata": {
"cwe_ids": [
"CWE-1333",
"CWE-400"
],
"cna_assigner": "VulDB",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/6xxx/CVE-2025-6493.json"
}
},
"related_cves": [
{
"value": "CVE-2025-6493",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 499491,
"published_at": "2025-06-22T22:00:10.483+00:00"
}