PT-2023-20600 · Pypi · Markdown-It-Py

Chris Sewell + 2 · Published 2023-02-22 · Updated 2026-06-03 · CVE-2023-26302

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions markdown-it-py versions prior to 2.2.0

Description Denial of service could be caused to the command line interface of markdown-it-py if an attacker was allowed to use invalid UTF-8 characters as input.

Recommendations For versions prior to 2.2.0, update to version 2.2.0 or later to resolve the issue. As a temporary workaround, consider restricting input to valid UTF-8 characters to minimize the risk of exploitation.

Fix

DoS

Weakness Enumeration

CWE-173

Related Identifiers

CVE-2023-26302

GHSA-JRWR-5X3P-HVC3

PYSEC-2023-23

Affected Products

Markdown-It-Py

References · 18

• https://github.com/executablebooks/markdown-it-py/commit/53ca3e9c2b9e9b295f6abf7f4ad2730a9b70f68c · Patch
• https://osv.dev/vulnerability/GHSA-jrwr-5x3p-hvc3 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-APP-PYPI-CVE-2023-26302 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-26302 · Security Note
• https://osv.dev/vulnerability/PYSEC-2023-23 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-26302 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-26302 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-26302 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-26302 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-26302 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-26302 · Security Note
• https://github.com/executablebooks/markdown-it-py/pull/247 · Note
• https://github.com/executablebooks/markdown-it-py/releases/tag/v2.2.0 · Note
• https://github.com/executablebooks/markdown-it-py · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/markdown-it-py/PYSEC-2023-23.yaml · Note