GHSA-fvx8-79hx-x82f

Django MarkdownX Cross-Site Scripting (XSS) vulnerability

Source: GitHub Advisory Database (reviewed) Moderate CVE-2024-2319

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	django-markdownx	<= 4.0.2	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

Cross-Site Scripting (XSS) vulnerability in the Django MarkdownX project, affecting version 4.0.2. An attacker could store a specially crafted JavaScript payload in the upload functionality due to lack of proper sanitisation of JavaScript elements.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2024-2319 advisory
https://github.com/neutronX/django-markdownx package
https://www.incibe.es/en/incibe-cert/notices/aviso/cross-site-scripting-vulnerability-django-markdownx web