RUSTSEC-2021-0026: XSS in `comrak`

What to do

1. See which version you have: cargo tree -i comrak (it also shows which of your dependencies pulls it in).
2. Update within your version requirement: cargo update -p comrak. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for example comrak = "0.9.1") or update the dependency that pulls it in.
3. Check again with cargo audit, or paste your Cargo.lock into our Cargo.toml checker.

Details from the advisory

The comrak we were matching unsafe URL prefixes, such as data: or javascript: , in a case-sensitive manner. This meant prefixes like Data: were untouched.

References

• Package: crates.io/crates/comrak
• Advisory: rustsec.org/advisories/RUSTSEC-2021-0026.html
• Web: github.com/kivikakk/comrak/releases/tag/0.9.1

From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.

Other advisories for comrak

• VulnerabilityRUSTSEC-2021-0063 · 2021-05-04XSS in `comrak`
• VulnerabilityGHSA-5r3x-p7xx-x6q5 · 2023-03-28Comrak AST node data is not validated (GHSL-2023-049)
• VulnerabilityGHSA-8hqf-xjwp-p67v · 2023-03-28Comrak vulnerable to quadratic runtime issues when parsing Markdown (GHSL-2023-047)
• VulnerabilityGHSA-xxmq-4vph-956w · 2023-03-28Comrak vulnerable to production of excessive output when parsing Markdown (GHSL-2023-048)

Full security history of comrak