GHSA-5wmx-573v-2qwq · Severity: medium · Ecosystem: pip — Python-Markdown has an Uncaught Exception
Python-Markdown version 3.8 contain a vulnerability where malformed HTML-like sequences can cause html.parser.HTMLParser to raise an unhandled AssertionError during Markdown parsing. Because Python-Markdown does not catch this exception, any application that processes attacker-controlled Markdown may crash. This enables remote, unauthenticated Denial of Service in web applications, documentation systems, CI/CD pipelines, and any service that renders untrusted Markdown. The issue was acknowledged by the vendor and fixed in version 3.8.1. This issue causes a remote Denial of Service in any application parsing untrusted Markdown, and can lead to Information Disclosure through uncaught exceptions.
Conclusion & alert: CVE-2025-69534 is rated Exploit Available (57.9/100): CVSS High severity, with low exploitation likelihood (EPSS 0.46%). Core evidence: 1 public exploit reference(s) are indexed (Exploit-DB). Mandatory action: Public exploits are available—assess exposure, apply mitigations, and prioritize patching.
Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.
| EDB-ID | Source | Kind | Published | Link |
|---|---|---|---|---|
| — | nvd_ref | exploit_tag | Exploit-DB ↗ |
EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).
| # | Date | Old EPSS score | New EPSS score | Delta (New - Old) |
|---|---|---|---|---|
| 1 | 2026-06-15 | 0.37% | 0.46% | +0.10% |
| 2 | 2026-04-16 | 0.27% | 0.37% | +0.10% |
| 3 | 2026-04-06 | — | 0.27% | — |
Full EPSS history (5 records total)
CVSS metrics for this CVE.
| Base score | Version | Severity | Vector | Exploitability | Impact | Score source |
|---|---|---|---|---|---|---|
| 7.5 | 3.1 | HIGH |
|
3.9 | 3.6 | [email protected] |
| 7.5 | 3.1 | HIGH |
|
3.9 | 3.6 | 134c704f-9b21-4f2e-91b3-4a467353bcc0 |
GHSA-5wmx-573v-2qwq · Severity: medium · Ecosystem: pip — Python-Markdown has an Uncaught Exception
| vendor | priority | summary | link |
|---|---|---|---|
alpine
|
— | CVE-2025-69534: 1 source package rows (py3-markdown); 2 state rows across 2 repos (3.22-main, edge-main); fixed 0, open 2. | https://security.alpinelinux.org/vuln/CVE-2025-69534 |
debian
|
end-of-life | CVE-2025-69534 end-of-life priority: Debian including 6 source packages (pypy3, python2.7, python3.11, python3.13, python3.14, python3.9), 13 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): open 8, resolved 5. | https://security-tracker.debian.org/tracker/CVE-2025-69534 |
redhat
|
high | — | https://access.redhat.com/security/cve/CVE-2025-69534 |
suse
|
high | CVE-2025-69534 severity important: SUSE including 3 source package names (python-Markdown, python311-Markdown-3.5.2-150600.3.3.1, python313-Markdown), 5 product×package rows across 3 product lines (SUSE Linux Enterprise Server 16.0, SUSE Linux Enterprise Server for SAP applications 16.0, openSUSE Leap 15.6): Known Not Affected 4, Fixed 1. | https://www.suse.com/security/cve/CVE-2025-69534/ |
ubuntu
|
medium | CVE-2025-69534 medium priority: Ubuntu including 13 source packages (pypy3, python2.7, …), 65 status rows across 8 suites (bionic, focal, jammy, noble, questing, trusty, upstream, xenial): needs-triage 35, DNE 30. | https://ubuntu.com/security/CVE-2025-69534 |
| Vendor | Product | Version | Raw CPE |
|---|---|---|---|
| python-markdown | markdown | 3.8 | cpe:2.3:a:python-markdown:markdown:3.8:*:*:*:*:python:*:* |
| URL | Tags |
|---|---|
| https://github.com/Python-Markdown/markdown | Product |
| https://github.com/Python-Markdown/markdown/actions/runs/15736122892 | Product |
| https://github.com/Python-Markdown/markdown/issues/1534 | Exploit Issue Tracking |
| http://www.openwall.com/lists/oss-security/2026/03/06/4 | Mailing List Third Party Advisory |