Description
python-markdown2 through 2.3.8 allows XSS because element names are mishandled unless a \w+ match succeeds. For example, an attack might use elementname@ or elementname- with an onclick attribute.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | python-markdown2 | 2.3.9-1 | — |
| Debian 13 | python-markdown2 | 2.3.9-1 | — |
| Debian 12 | python-markdown2 | 2.3.9-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | python-markdown2 | No fix yet | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE Package Hub 15 SP1 | python-markdown2 | 2.3.7-bp151.2.3.1 | openSUSE-SU-2020:0656-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 15.1 | python-markdown2 | 2.3.7-lp151.2.3.1 | openSUSE-SU-2020:0651-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | markdown2 | < 2.3.9 | 2.3.9 | GHSA-fv3h-8x5j-pvgq |
Advisories 2
- openSUSE-SU-2020:0656-1 Security update for python-markdown2 SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2020:0651-1 Security update for python-markdown2 SUSE / openSUSE Security Updates · Feb 4, 2026
References
- https://github.com/trentm/python-markdown2/issues/348
- openSUSE-SU-2020:0651 vendor-advisory
- openSUSE-SU-2020:0656 vendor-advisory
- FEDORA-2020-5f8f90e69c vendor-advisory
- FEDORA-2020-3864f32b3d vendor-advisory
- FEDORA-2020-ab379d4b90 vendor-advisory