CVSS 3.0
6.1 mediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NCVE-2018-5773
Medium (6.1) in python-markdown2 project python-markdown2. EPSS 0.8% chance of exploitation in the next 30 days. Fixed in markdown2 2.3.6.
An issue was discovered in markdown2 (aka python-markdown2) through 2.3.5. The safe_mode feature, which is supposed to sanitize user input against XSS, is flawed and does not escape the input properly. With a crafted payload, XSS can be triggered, as demonstrated by omitting the final '>' character from an IMG tag.
Severity
- EPSS
- 0.8% chance of exploitation in the next 30 days; higher than 57% of CVEs (scores of 2026-10-31)
- CWE
- CWE-79
- Published
- Modified
- Record from
- the NVD, synced
Affected
- python-markdown2_project:python-markdown2
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-p6h9-gw49-rqm4 | PyPI | markdown2 | <2.3.6 | 2.3.6 |
| PYSEC-2018-13 | PyPI | markdown2 | <2.3.6 | 2.3.6 |