PT-2023-20601 · Pypi · Markdown-It-Py

Chris Sewell + 2 · Publicado 2023-02-22 · Atualizado 2026-06-03 · CVE-2023-26303

Positive Technologies (AI Summary)

CVSS v4.0

7.1

Alta

Vetor base

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions markdown-it-py versions prior to 2.2.0

Description A denial of service could be caused if an attacker is allowed to force null assertions with specially crafted input.

Recommendations For versions prior to 2.2.0, update to version 2.2.0 or later to resolve the issue.

Correção

DoS

Enumeração de Fraquezas

CWE-173

Identificadores relacionados

CVE-2023-26303

GHSA-VRJV-MXR7-VJF8

OPENSUSE-SU-2024:12772-1

PYSEC-2023-24

Produtos afetados

Markdown-It-Py

Referências · 19

• https://github.com/executablebooks/markdown-it-py/commit/ae03c6107dfa18e648f6fdd1280f5b89092d5d49 · Correção
• https://github.com/executablebooks/markdown-it-py/commit/53ca3e9c2b9e9b295f6abf7f4ad2730a9b70f68c · Nota
• https://github.com/executablebooks/markdown-it-py/pull/246 · Nota
• https://github.com/executablebooks/markdown-it-py · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/markdown-it-py/PYSEC-2023-24.yaml · Nota
• https://osv.dev/vulnerability/PYSEC-2023-24 · Aviso do Fabricante
• https://osv.dev/vulnerability/ROOT-APP-PYPI-CVE-2023-26303 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2023-26303 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-26303 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-vrjv-mxr7-vjf8 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2023-26303 · Nota de Segurança
• https://t.me/cvenotify/114329 · Publicação no Telegram
• https://osv.dev/vulnerability/openSUSE-SU-2024:12772-1 · Aviso do Fabricante
• https://github.com/advisories/GHSA-vrjv-mxr7-vjf8 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-26303 · Aviso do Fabricante