CVE-2020-11888 XSS in python-markdown2
An attacker can execute arbitrary JavaScript in the context of users viewing markdown content due to improper element name handling in the python-markdown2 library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2020-11888?
CVE-2020-11888 is a medium-severity cross-site scripting vulnerability in n/a, published on 20 Apr 2020. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
python-markdown2 through 2.3.8 allows XSS because element names are mishandled unless a \w+ match succeeds. For example, an attack might use elementname@ or elementname- with an onclick attribute.
Weakness: CWE-79
Which versions are affected by CVE-2020-11888?
3 open source packages ship an affected version, including markdown2. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
markdown2 PyPI | All versions | 2.3.9 |
markdown2 PyPI | All versions | 2.3.9 |
markdown2 PyPI | All versions | 2.3.9 |
Linux distribution packages (2)
python-markdown2 SUSE:Package Hub 15 SP1 | All versions | 2.3.7-bp151.2.3.1 |
python-markdown2 openSUSE:Leap 15.1 | All versions | 2.3.7-lp151.2.3.1 |
Products include Python-Markdown2 Project Python-Markdown2.
How do I fix CVE-2020-11888?
Upgrade markdown2 to 2.3.9 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2020-11888 being exploited?
There is no known exploitation of CVE-2020-11888 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as DEBIAN-CVE-2020-11888, GHSA-fv3h-8x5j-pvgq, PYSEC-2020-65, UBUNTU-CVE-2020-11888, openSUSE-SU-2020:0651-1, openSUSE-SU-2020:0656-1.