Markdown
Monthly
Out-of-bounds read in the 92181 markdown C library's lds() function allows remote unauthenticated attackers to read memory beyond the intended buffer by supplying crafted markdown input. The flaw exists in md.c prior to commit c000d2f9cf390c315378d3717cf20911cf3e80a6, where the lds() function iterated over space characters without enforcing an end-of-buffer boundary. The CVSS 4.0 vector (6.9) reflects low confidentiality, integrity, and availability impact; no public exploit or CISA KEV listing exists at time of analysis.
Python-Markdown version 3.8 contain a vulnerability where malformed HTML-like sequences can cause html.parser.HTMLParser to raise an unhandled AssertionError during Markdown parsing. [CVSS 7.5 HIGH]
The package `github.com/gomarkdown/markdown` is a Go library for parsing Markdown text and rendering as HTML. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
PHP cebe markdown parser version 1.2.0 and earlier contains a Cross Site Scripting (XSS) vulnerability in all distributed parsers allowing a malicious crafted script to be executed that can result in. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Out-of-bounds read in the 92181 markdown C library's lds() function allows remote unauthenticated attackers to read memory beyond the intended buffer by supplying crafted markdown input. The flaw exists in md.c prior to commit c000d2f9cf390c315378d3717cf20911cf3e80a6, where the lds() function iterated over space characters without enforcing an end-of-buffer boundary. The CVSS 4.0 vector (6.9) reflects low confidentiality, integrity, and availability impact; no public exploit or CISA KEV listing exists at time of analysis.
Python-Markdown version 3.8 contain a vulnerability where malformed HTML-like sequences can cause html.parser.HTMLParser to raise an unhandled AssertionError during Markdown parsing. [CVSS 7.5 HIGH]
The package `github.com/gomarkdown/markdown` is a Go library for parsing Markdown text and rendering as HTML. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
PHP cebe markdown parser version 1.2.0 and earlier contains a Cross Site Scripting (XSS) vulnerability in all distributed parsers allowing a malicious crafted script to be executed that can result in. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.