Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

trentm/python-markdown2

              master @ ee81a6b
            

Fixes

CVEs

HIGH

Peak severity

Highlights

Cross-Site Scripting (XSS): 2 prior fixes. Scrutinize any change in this area.

lib/markdown2.py: most-fixed (3 issues). Treat as high-risk during review.

3 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Cross-Site Scripting (XSS): Attackers can bypass 'safe_mode' sanitization via incomplete HTML tags ending in '>' which the parser misinterprets as harmless auto-links rather than potential script injection points.

Reflected XSS: Malicious attributes placed inside image URL references can evade HTML escaping rules if they are obfuscated or hidden within unhashed code blocks during URL tokenization.

Cross-Site Scripting (XSS): Unquoted HTML attributes inside tags can bypass the standard tag-matching regex engine, allowing arbitrary HTML/JS to pass through 'safe_mode' unescaped.