PYSEC-2020-65

See a problem?
Import Source
https://github.com/pypa/advisory-database/blob/main/vulns/markdown2/PYSEC-2020-65.yaml
JSON Data
https://api.osv.dev/v1/vulns/PYSEC-2020-65
Aliases
Published
2020-04-20T16:15:00Z
Modified
2023-11-08T04:02:07.747183Z
Summary
[none]
Details

python-markdown2 through 2.3.8 allows XSS because element names are mishandled unless a \w+ match succeeds. For example, an attack might use elementname@ or elementname- with an onclick attribute.

References

Affected packages

PyPI / markdown2

Package

Name
markdown2
View open source insights on deps.dev
Purl
pkg:pypi/markdown2

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.3.9

Affected versions

1.*

1.0.1.6
1.0.1.7
1.0.1.8
1.0.1.9
1.0.1.10
1.0.1.11
1.0.1.12
1.0.1.13
1.0.1.14
1.0.1.15
1.0.1.16
1.0.1.17
1.0.1.18
1.0.1.19
1.1.0
1.1.1
1.2.0
1.3.0
1.3.1
1.4.0
1.4.1
1.4.2

2.*

2.0.0
2.0.1
2.1.0
2.2.0
2.2.1
2.2.2
2.2.3
2.3.0
2.3.1
2.3.2
2.3.3
2.3.4
2.3.5
2.3.6
2.3.7
2.3.8

Database specific

source

"https://github.com/pypa/advisory-database/blob/main/vulns/markdown2/PYSEC-2020-65.yaml"