Skip to content

chore(deps): update dependency markdown to v3.8.1 [security]#1716

Open
renovate[bot] wants to merge 1 commit intomasterfrom
renovate/pypi-markdown-vulnerability
Open

chore(deps): update dependency markdown to v3.8.1 [security]#1716
renovate[bot] wants to merge 1 commit intomasterfrom
renovate/pypi-markdown-vulnerability

Conversation

@renovate
Copy link
Contributor

@renovate renovate bot commented Mar 6, 2026

This PR contains the following updates:

Package Change Age Confidence
Markdown (changelog) 3.83.8.1 age confidence

GitHub Vulnerability Alerts

CVE-2025-69534

Python-Markdown version 3.8 contain a vulnerability where malformed HTML-like sequences can cause html.parser.HTMLParser to raise an unhandled AssertionError during Markdown parsing. Because Python-Markdown does not catch this exception, any application that processes attacker-controlled Markdown may crash. This enables remote, unauthenticated Denial of Service in web applications, documentation systems, CI/CD pipelines, and any service that renders untrusted Markdown. The issue was acknowledged by the vendor and fixed in version 3.8.1. This issue causes a remote Denial of Service in any application parsing untrusted Markdown, and can lead to Information Disclosure through uncaught exceptions.


Release Notes

Python-Markdown/markdown (Markdown)

v3.8.1

Compare Source

Fixed
  • Ensure incomplete markup declaration in raw HTML doesn't crash parser (#​1534).
  • Fixed dropped content in md_in_html (#​1526).
  • Fixed HTML handling corner case that prevented some content from not being rendered (#​1528).

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot added the dependencies Pull requests that update a dependency file label Mar 6, 2026
@renovate renovate bot force-pushed the renovate/pypi-markdown-vulnerability branch from a6b0796 to dea4ad5 Compare March 13, 2026 13:19
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file

0 participants