markdown-it (npm) has 8 known vulnerabilities, the worst rated HIGH. Upgrade to 15.0.3 or later to clear all of them. No malicious-package signal is recorded.
CyberXYZ does not call a package safe in absolute terms. It records 8 known vulnerabilities for markdown-it (npm), the worst rated HIGH, and no malicious-package signal. Whether it is acceptable depends on the version you run.
Does markdown-it have known vulnerabilities?
Yes. CyberXYZ records 8 known vulnerabilities for markdown-it (npm), the worst rated HIGH. These include GHSA-gfr2-rv44-r23c, GHSA-r7fv-28h4-cvq7, GHSA-j5p7-jf4q-742q, GHSA-253c-mchw-3w2r, GHSA-6v5v-wf23-fmfq.
Which version of markdown-it should I use?
15.0.3 or later clears every advisory recorded for markdown-it (npm). Check the release you pick before installing it.
How do I check markdown-it before installing?
Search markdown-it in CyberXYZ Check at https://cyberxyz.io/check?q=markdown-it. The xyz Scanner checks a project's dependencies, and CyberXYZ Proxy checks each package as it is installed.
Checked 2026-11-14 at 06:44 UTC. The most recent advisory here was published 2026-10-20. Updated continuously from NVD, GHSA, OSV and CNA feeds.