CVE-2018-5773: markdown2 is vulnerable to cross-site scripting
(updated )
An issue was discovered in markdown2 (aka python-markdown2) through 2.3.5. The safe_mode feature, which is supposed to sanitize user input against XSS, is flawed and does not escape the input properly. With a crafted payload, XSS can be triggered, as demonstrated by omitting the final > character from an IMG tag.
References
- github.com/advisories/GHSA-p6h9-gw49-rqm4
- github.com/google/osv/issues/430
- github.com/pypa/advisory-database/tree/main/vulns/markdown2/PYSEC-2018-13.yaml
- github.com/trentm/python-markdown2
- github.com/trentm/python-markdown2/blob/master/CHANGES.md
- github.com/trentm/python-markdown2/commit/1b1dcdd727c0ef03453b9f5ef5ae3679f1d72323
- github.com/trentm/python-markdown2/issues/285
- github.com/trentm/python-markdown2/pull/303
- nvd.nist.gov/vuln/detail/CVE-2018-5773
Code Behaviors & Features
Detect and mitigate CVE-2018-5773 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →