Python-Markdown has an Uncaught Exception
Python-Markdown version 3.8 contain a vulnerability where malformed HTML-like sequences can cause html.parser.HTMLParser to raise an unhandled AssertionError during Markdown parsing. Because Python-Markdown does not catch this exception, any application that processes attacker-controlled Markdown may crash. This enables remote, unauthenticated Denial of Service in web applications, documentation systems, CI/CD pipelines, and any service that renders untrusted Markdown. The issue was acknowledged by the vendor and fixed in version 3.8.1. This issue causes a remote Denial of Service in any application parsing untrusted Markdown, and can lead to Information Disclosure through uncaught exceptions.
Software afectado
Haz clic en una tecnología para ver todas sus vulnerabilidades.
| Plataforma | Paquete | Versiones vulnerables | Corregida en |
|---|---|---|---|
| Python (PyPI) | markdown | < 3.8.1 | 3.8.1 |
Referencias
- https://github.com/Python-Markdown/markdown/actions/runs/15736122892
- http://www.openwall.com/lists/oss-security/2026/03/06/4
- https://github.com/Python-Markdown/markdown/issues/1534
- https://github.com/Python-Markdown/markdown
- https://github.com/advisories/GHSA-5wmx-573v-2qwq
- https://nvd.nist.gov/vuln/detail/CVE-2025-69534
- https://github.com/Python-Markdown/markdown/pull/1535
- https://github.com/pypa/advisory-database/tree/main/vulns/markdown/PYSEC-2026-89.yaml
- Vector CVSS
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H- Debilidad (CWE)
CWE-248, CWE-400- Plataforma
- Python (PyPI)
- Paquete
markdown- Publicada
- 05.03.2026
- Actualizado
- 11.10.2026 15:17
Fuentes y licencias
OSV / GitHub Advisory Database - PYSEC-2026-89 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - GHSA-5wmx-573v-2qwq - CC BY 4.0
Historial de vulnerabilidades: markdown
Todas las vulnerabilidades publicadas de este paquete (Python (PyPI)), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.
Esta es la única vulnerabilidad conocida de este paquete.
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.