Product
2 published CVES affecting crates.io pulldown-cmark, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).
Newest publication first
With Options::ENABLE_WIKILINKS, handle_wikilink builds a wikilink's target from the raw text of its body: scan_wikilink_pipe walks it looking for |, then contains('\0') and from_replace_nuls walk it again. Once a wikilink is created, disable_all_links only disables Link entries,...
When Options::ENABLE_WIKILINKS is enabled, a wikilink with a pipe separator and empty display text, such as [[a|]], leaks its child node's sibling chain into the content that follows it. Each such link roughly doubles the number of events the parser yields for the rest of the doc...
Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.