CVE-2026-88753: Pypi/markdown2 vulnerability

Q: What does an attacker need to exploit this issue?

An attacker needs to be able to supply a crafted Markdown document that is processed by markdown2's extract_metadata() function. The crafted input can trigger excessive regular-expression processing and cause denial of service.

Q: Which releases are affected?

The issue affects trentm markdown2 through version 2.5.5. The provided information does not identify a fixed version.

Q: Who is exposed in practice?

Applications are exposed when they process attacker-controlled Markdown using the affected markdown2 functionality, particularly where extract_metadata() is reached during document handling. The impact described is service unavailability rather than unauthorized access or data disclosure.

Published Oct 15, 2026

Updated

A Regular-Expression Denial of Service (ReDoS) in the Markdown2. extractmetadata() function (lib/markdown2.py) of trentm markdown2 through v2.5.5 allows attackers to cause a Denial of Service (DoS) via a crafted Markdown document.

Affected Software

1 affected component

pypi/markdown2<=2.5.5

Event History

Oct 15, 2026

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Frequently Asked Questions

What does an attacker need to exploit this issue?

An attacker needs to be able to supply a crafted Markdown document that is processed by markdown2's extract_metadata() function. The crafted input can trigger excessive regular-expression processing and cause denial of service.

Which releases are affected?

The issue affects trentm markdown2 through version 2.5.5. The provided information does not identify a fixed version.

Who is exposed in practice?

Applications are exposed when they process attacker-controlled Markdown using the affected markdown2 functionality, particularly where extract_metadata() is reached during document handling. The impact described is service unavailability rather than unauthorized access or data disclosure.