彙總 python-markdown2_project 相關全部產品的 CVE 與安全漏洞情報，包括 CVSS、EPSS、公開時間與漏洞情報資料。
常見弱點模式包括 跨站腳本，在 生產負載與軟體部署 使用場景中可能帶來 工作階段劫持 等風險。
相關漏洞資料主要來源於公開漏洞披露與安全公告，可用於評估歷史漏洞暴露面與修補優先順序。
| CVE | 摘要 | 來源 | 最高 CVSS | EPSS % | 公開時間 | 更新時間 |
|---|---|---|---|---|---|---|
| CVE-2020-11888 | python-markdown2 through 2.3.8 allows XSS because element names are mishandled unless a \w+ match succeeds. For example, an attack might use elementname@ or elementname- with an onclick attribute. | [email protected] | 6.1 | 1.87% | 2020-04-20 | 2026-06-16 |
| CVE-2009-3724 | python-markdown2 before 1.0.1.14 has multiple cross-site scripting (XSS) issues. | [email protected] | 6.1 | 0.77% | 2020-01-15 | 2026-06-16 |
| CVE-2018-5773 | An issue was discovered in markdown2 (aka python-markdown2) through 2.3.5. The safe_mode feature, which is supposed to sanitize user input against XSS, is flawed and does not escape the input properly. With a crafted payload, XSS can be triggered, as demonstrated by omitting the final '>' character from an IMG tag. | [email protected] | 6.1 | 0.83% | 2018-01-18 | 2026-06-16 |