XSS in python-markdown2
Moderate severity
GitHub Reviewed
Published
Apr 22, 2020
to the GitHub Advisory Database
•
Updated Sep 1, 2023
Description
Reviewed
Apr 22, 2020
Published to the GitHub Advisory Database
Apr 22, 2020
Last updated
Sep 1, 2023
python-markdown2 through 2.3.8 allows XSS because element names are mishandled unless a \w+ match succeeds. For example, an attack might use elementname@ or elementname- with an onclick attribute.
References