← Back

Python Markdown2

python-markdown2

Vendor: Python Markdown2 Project • 3 CVEs

CVEs (3)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2020-11888
1Python Markdown2 Project
1Python Markdown2
Jun 17, 2026
Apr 20, 2020
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
python-markdown2 through 2.3.8 allows XSS because element names are mishandled unless a \w+ match succeeds. For example, an attack might use elementname@ or elementname- with an onclick attribute.
CVE-2009-3724
1Python Markdown2 Project
1Python Markdown2
Nov 21, 2024
Jan 15, 2020
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
python-markdown2 before 1.0.1.14 has multiple cross-site scripting (XSS) issues.
CVE-2018-5773
1Python Markdown2 Project
1Python Markdown2
Jun 17, 2026
Jan 18, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
An issue was discovered in markdown2 (aka python-markdown2) through 2.3.5. The safe_mode feature, which is supposed to sanitize user input against XSS, is flawed and does not escape the input properly. With a crafted pay...Show more
An issue was discovered in markdown2 (aka python-markdown2) through 2.3.5. The safe_mode feature, which is supposed to sanitize user input against XSS, is flawed and does not escape the input properly. With a crafted payload, XSS can be triggered, as demonstrated by omitting the final '>' character from an IMG tag.Show less