CVE-2020-11888

Vulnerability

Overview python-markdown2 versions up to 2.3.8 are vulnerable to a stored cross-site scripting (XSS) attack because the library mishandles HTML element names when converting Markdown to HTML. The flaw lies in the element name validation: the code expects names to match the regex \w+, but fails to reject names that include characters like @ or - after the initial match. As a result, an attacker can inject arbitrary attributes, such as onclick, to execute malicious scripts [1][2].

Exploitation

An attacker can exploit this by submitting Markdown content that includes a crafted HTML tag, for example: <elementname@ onclick="alert(1)">. If the application renders this Markdown without proper sanitization, the malicious tag is processed and the onclick handler is injected into the generated HTML. No authentication is required if the application processes untrusted user input, making this a critical issue for services that allow user-generated content [1].

Impact

Successful exploitation leads to cross-site scripting (XSS), enabling an attacker to steal session cookies, deface websites, redirect users to malicious sites, or perform other actions in the context of the victim's browser. This can compromise the confidentiality and integrity of the application and its users [3].

Mitigation

The vulnerability is fixed in python-markdown2 versions after 2.3.8. Users should upgrade to the latest version as soon as possible. For those unable to upgrade, a workaround may be to sanitize user input before processing it with markdown2. The advisory has been published in the PySec advisory database and distributions like Fedora have issued updates [4].