CVE-2018-5773: Python-MARKDOWN2 Project Python-MARKDOWN2

Medium severity, CVSS 6.1. EPSS: 0.8% chance of exploitation in the next 30 days.

An issue was discovered in markdown2 (aka python-markdown2) through 2.3.5. The safe_mode feature, which is supposed to sanitize user input against XSS, is flawed and does not escape the input properly. With a crafted payload, XSS can be triggered, as demonstrated by omitting the final '>' character from an IMG tag.

Affected products

• Python-MARKDOWN2 Project Python-MARKDOWN2: up to and including 2.3.5

Published 2018-01-18. Last modified 2026-06-17.