~ / search / GHSA-fv3h-8x5j-pvgq

GHSA-fv3h-8x5j-pvgq

XSS in python-markdown2

Source: GitHub Advisory Database (reviewed) Moderate CVE-2020-11888

Packages

EcosystemPackageAffectedFixed in
PyPI markdown2 < 2.3.9 2.3.9

Details

As written in the advisory (Markdown source, shown as plain text).

python-markdown2 through 2.3.8 allows XSS because element names are mishandled unless a \w+ match succeeds. For example, an attack might use elementname@ or elementname- with an onclick attribute.

References

External links from the advisory. They lead to third-party sites.