CVE-2020-11888: XSS in python-markdown2
Summary
CVE-2020-11888: XSS in python-markdown2. Affects markdown2 versions < 2.3.9. Fixed in 2.3.9. How to fix ↓
Also tracked for
- python-markdown2 · Debian:11
The same CVE-2020-11888 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
python-markdown2 is a Python library that converts Markdown text into HTML. It is widely used for rendering Markdown content in various applications. However, versions up to 2.3.8 of python-markdown2 are vulnerable to a cross-site scripting (XSS) attack. This vulnerability occurs due to mishandling of element names unless a \w+ match succeeds. An attacker can exploit this by using element names like elementname@ or elementname- with an onclick attribute, leading to the execution of arbitrary JavaScript code in the context of the victim's browser.
Vulnerability Detail
The XSS vulnerability in python-markdown2 can have serious consequences. An attacker can craft malicious Markdown content that, when rendered by an application using the vulnerable library, can execute arbitrary JavaScript code in the victim's browser. This can lead to various attacks, such as stealing sensitive information, session hijacking, or performing actions on behalf of the victim. The vulnerability is rated as moderate severity with a CVSS score of 6.1.
How To Fix
Latest published version: 2.5.5 as of 23 Oct 2026
pip install --upgrade "markdown2==2.5.5"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.3.9
This is the first release that contains the fix.
pip install --upgrade "markdown2==2.3.9"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround is to sanitize the Markdown content before rendering it. This can be done by using a HTML sanitizer library or implementing custom sanitization logic to remove any potentially malicious elements or attributes. Here is an example of how to use the bleach library to sanitize the Markdown content:
import bleach
markdown_content = '...' # Markdown content to sanitize
sanitized_content = bleach.clean(markdown_content)
Conclusion
The XSS vulnerability in python-markdown2 can have serious security implications. It is crucial to upgrade to the latest version of the library (2.3.9 or later) to mitigate the risk. If immediate upgrade is not possible, ensure to sanitize user-generated Markdown content before rendering it. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for markdown2 →
FAQ
python-markdown2 is a Python library that converts Markdown text into HTML. It is commonly used in web applications, content management systems, and other platforms to render Markdown content.
Cross-site scripting (XSS) is a type of security vulnerability where an attacker injects malicious scripts into a trusted website or application. These scripts are then executed by unsuspecting users, leading to various attacks such as stealing sensitive information or performing actions on behalf of the user.
The XSS vulnerability in python-markdown2 occurs due to mishandling of element names. If an element name does not match the \w+ pattern, it is not properly sanitized, allowing an attacker to inject arbitrary JavaScript code.
The XSS vulnerability in python-markdown2 can lead to various attacks, including stealing sensitive information, session hijacking, or performing actions on behalf of the victim. It depends on how the rendered HTML is used in the application.
To protect your application, it is recommended to upgrade to the latest version of python-markdown2 (2.3.9 or later) that includes a fix for the XSS vulnerability. Additionally, always sanitize user-generated Markdown content before rendering it to prevent any potential XSS attacks.
References
Related vulnerabilities
Recent vulnerabilities recorded for markdown2.
