CVE-2018-5773: markdown2 - Cross-Site Scripting Vulnerability
Summary
CVE-2018-5773: markdown2 is vulnerable to cross-site scripting. Affects markdown2 versions < 2.3.6. Fixed in 2.3.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
markdown2 is a Python package that converts Markdown text into HTML. It provides a simple and convenient way to format and display text on websites or in other applications. However, versions up to 2.3.5 of markdown2 are vulnerable to a cross-site scripting (XSS) attack.
Vulnerability Detail
The safe_mode feature in markdown2, which is designed to sanitize user input and prevent XSS attacks, is flawed and does not properly escape input. This allows an attacker to craft a payload that can trigger XSS by omitting the final > character from an IMG tag. This vulnerability can lead to the execution of malicious scripts in the context of the affected user's browser, potentially compromising their sensitive information or performing unauthorized actions.
How To Fix
Latest published version: 2.5.5 as of 23 Oct 2026
pip install --upgrade "markdown2==2.5.5"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.3.6
This is the first release that contains the fix.
pip install --upgrade "markdown2==2.3.6"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately possible, a temporary workaround is to disable the safe_mode feature in markdown2. However, this may leave your application vulnerable to other XSS attacks. To disable safe_mode, you can modify the code where markdown2 is used and set the safe_mode parameter to False. For example:
text = '...' # Markdown text
html = markdown2.markdown(text, safe_mode=False)
Conclusion
The markdown2 package up to version 2.3.5 is vulnerable to a cross-site scripting (XSS) attack due to a flaw in the safe_mode feature. Upgrading to version 2.3.6 or later is the recommended solution to fix this vulnerability. If immediate upgrade is not possible, disabling safe_mode can serve as a temporary workaround. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for markdown2 →
FAQ
markdown2 is a Python package that converts Markdown text into HTML. It is commonly used in web applications to format and display user-generated content.
Cross-site scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. This can lead to the theft of sensitive information or the execution of unauthorized actions.
The markdown2 XSS vulnerability occurs due to a flaw in the safe_mode feature, which fails to properly escape user input. By crafting a payload that omits the final > character from an IMG tag, an attacker can trigger XSS and execute malicious scripts in the context of the affected user's browser.
Exploiting this vulnerability can allow an attacker to steal sensitive information, such as login credentials or personal data, from users who view the compromised content. It can also enable the attacker to perform unauthorized actions on behalf of the user, potentially leading to further compromise or damage.
To protect your application, it is recommended to upgrade markdown2 to version 2.3.6 or later, which includes a fix for the XSS vulnerability. Additionally, ensure that user-generated content is properly sanitized and validated to prevent the injection of malicious scripts.
References
Related vulnerabilities
Recent vulnerabilities recorded for markdown2.
