PT-2023-20600 · Pypi · Markdown-It-Py

Chris Sewell + 2 · Publicado 2023-02-22 · Atualizado 2026-06-03 · CVE-2023-26302

Positive Technologies (AI Summary)

CVSS v4.0

7.1

Alta

Vetor base

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions markdown-it-py versions prior to 2.2.0

Description Denial of service could be caused to the command line interface of markdown-it-py if an attacker was allowed to use invalid UTF-8 characters as input.

Recommendations For versions prior to 2.2.0, update to version 2.2.0 or later to resolve the issue. As a temporary workaround, consider restricting input to valid UTF-8 characters to minimize the risk of exploitation.

Correção

DoS

Enumeração de Fraquezas

CWE-173

Identificadores relacionados

CVE-2023-26302

GHSA-JRWR-5X3P-HVC3

PYSEC-2023-23

Produtos afetados

Markdown-It-Py

Referências · 18

• https://github.com/executablebooks/markdown-it-py/commit/53ca3e9c2b9e9b295f6abf7f4ad2730a9b70f68c · Correção
• https://github.com/executablebooks/markdown-it-py/pull/247 · Nota
• https://github.com/executablebooks/markdown-it-py/releases/tag/v2.2.0 · Nota
• https://github.com/executablebooks/markdown-it-py · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/markdown-it-py/PYSEC-2023-23.yaml · Nota
• https://t.me/cibsecurity/58757 · Publicação no Telegram
• https://osv.dev/vulnerability/GHSA-jrwr-5x3p-hvc3 · Aviso do Fabricante
• https://osv.dev/vulnerability/ROOT-APP-PYPI-CVE-2023-26302 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-26302 · Nota de Segurança
• https://osv.dev/vulnerability/PYSEC-2023-23 · Aviso do Fabricante
• https://github.com/advisories/GHSA-jrwr-5x3p-hvc3 · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-26302 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-26302 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2023-26302 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2023-26302 · Aviso do Fabricante