PT-2023-20601 · Pypi · Markdown-It-Py

Chris Sewell + 2 · Published 2023-02-22 · Updated 2026-06-03 · CVE-2023-26303

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions markdown-it-py versions prior to 2.2.0

Description A denial of service could be caused if an attacker is allowed to force null assertions with specially crafted input.

Recommendations For versions prior to 2.2.0, update to version 2.2.0 or later to resolve the issue.

Fix

DoS

Weakness Enumeration

CWE-173

Related Identifiers

CVE-2023-26303

GHSA-VRJV-MXR7-VJF8

OPENSUSE-SU-2024:12772-1

PYSEC-2023-24

Affected Products

Markdown-It-Py

References · 19

• https://github.com/executablebooks/markdown-it-py/commit/ae03c6107dfa18e648f6fdd1280f5b89092d5d49 · Patch
• https://osv.dev/vulnerability/PYSEC-2023-24 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-APP-PYPI-CVE-2023-26303 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-26303 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-26303 · Security Note
• https://osv.dev/vulnerability/GHSA-vrjv-mxr7-vjf8 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-26303 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:12772-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-26303 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-26303 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-26303 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-26303 · Vendor Advisory
• https://github.com/executablebooks/markdown-it-py/commit/53ca3e9c2b9e9b295f6abf7f4ad2730a9b70f68c · Note
• https://github.com/executablebooks/markdown-it-py/pull/246 · Note
• https://github.com/executablebooks/markdown-it-py · Note