CVE-2020-11888

MEDIUM

python-markdown2 < 2.3.8 - Cross-Site Scripting via Mishandled Element Names

Title source: llm

Description

python-markdown2 through 2.3.8 allows XSS because element names are mishandled unless a \w+ match succeeds. For example, an attack might use elementname@ or elementname- with an onclick attribute.

References (6)

Core 6

Core References

Exploit, Third Party Advisory x_refsource_misc

https://github.com/trentm/python-markdown2/issues/348

Mailing List vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00031.html

Mailing List vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00035.html

Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PN6QSHRFZXRQAYZJQ4MOW5MKIXBYOMED/

Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AQLRBGRVRRZK7P5SFL2MNGXFX37YHJAV/

Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6XOAIRJJCZNJUALXDHSIGH5PS2H63A3J/

Scores

CVSS v3 6.1

EPSS 0.0187

EPSS Percentile 77.1%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Details

CWE

CWE-79

Status published

Products (2)

pypi/markdown2 0 - 2.3.9PyPI

python-markdown2_project/python-markdown2 < 2.3.8

Published Apr 20, 2020

Tracked Since Feb 18, 2026