Suggestions search

All statuses

Filter by:

With package: python311Packages.markdown-it-py

Found 3 matching suggestions

View:

Compact

Detailed

Untriaged

Permalink CVE-2025-7969

created 4 months ago

Markdown-it 14.1.0 - Cross-site scripting (XSS)

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in markdown-it allows Cross-Site Scripting (XSS). This vulnerability is associated with program files lib/renderer.mjs. This issue affects markdown-it: 14.1.0.

References

https://fluidattacks.com/advisories/fito third-party-advisory
https://github.com/markdown-it/markdown-it product
https://fluidattacks.com/advisories/fito exploit
https://fluidattacks.com/advisories/fito third-party-advisory
https://github.com/markdown-it/markdown-it product
https://fluidattacks.com/advisories/fito exploit
https://github.com/markdown-it/markdown-it/issues/1122
https://fluidattacks.com/advisories/fito third-party-advisory
https://github.com/markdown-it/markdown-it product
https://fluidattacks.com/advisories/fito exploit
https://github.com/markdown-it/markdown-it/issues/1122
https://fluidattacks.com/advisories/fito third-party-advisory
https://github.com/markdown-it/markdown-it product
https://fluidattacks.com/advisories/fito exploit
https://github.com/markdown-it/markdown-it/issues/1122

Affected products

markdown-it

==14.1.0

Matching in nixpkgs

pkgs.python311Packages.markdown-it-py

Markdown parser in Python

nixos-unstable 3.0.0
- nixpkgs-unstable 3.0.0
- nixos-unstable-small 3.0.0

pkgs.python312Packages.markdown-it-py

Markdown parser in Python

nixos-unstable 3.0.0
- nixpkgs-unstable 3.0.0
- nixos-unstable-small 3.0.0
nixos-25.11 3.0.0
- nixpkgs-25.11-darwin 3.0.0

pkgs.python313Packages.markdown-it-py

Markdown parser in Python

nixos-unstable 3.0.0
- nixpkgs-unstable 3.0.0
- nixos-unstable-small 3.0.0
nixos-25.11 3.0.0
- nixpkgs-25.11-darwin 3.0.0

Package maintainers

@bhipple Benjamin Hipple <bhipple@protonmail.com>

Dismissed

Permalink CVE-2023-26302

3.3 LOW

CVSS version: 3.1
Attack vector (AV): LOCAL
Attack complexity (AC): LOW
Privileges required (PR): LOW
User interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality impact (C): NONE
Integrity impact (I): NONE
Availability impact (A): LOW

updated 1 year ago by @LeSuisse Activity log

Created automatic suggestion 1 year, 1 month ago
@LeSuisse dismissed 1 year ago

markdown-it-py CLI crash on invalid UTF-8 characters

Denial of service could be caused to the command line interface of markdown-it-py, before v2.2.0, if an attacker was allowed to use invalid UTF-8 characters as input.