CVE-2018-5773

MEDIUM

python-markdown2 < 2.3.5 - Cross-Site Scripting via Safe Mode Bypass

Title source: llm
STIX 2.1

Description

An issue was discovered in markdown2 (aka python-markdown2) through 2.3.5. The safe_mode feature, which is supposed to sanitize user input against XSS, is flawed and does not escape the input properly. With a crafted payload, XSS can be triggered, as demonstrated by omitting the final '>' character from an IMG tag.

References (1)

Core 1
Core References
Third Party Advisory x_refsource_misc
https://github.com/trentm/python-markdown2/issues/285

Scores

CVSS v3 6.1
EPSS 0.0081
EPSS Percentile 53.2%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Details

CWE
CWE-79
Status published
Products (2)
pypi/markdown2 0 - 2.3.6PyPI
python-markdown2_project/python-markdown2 < 2.3.5
Published Jan 18, 2018
Tracked Since Feb 18, 2026