https://seclists.org/oss-sec/2026/q1/265: CVE-2025-69534 in Python-Markdown
Published Mar 6, 2026
·Updated
Affected Software
1 affected component
pypi/Markdown=3.8
Applications using Python-Markdown 3.8 that parse attacker-controlled or otherwise untrusted Markdown are exposed. Examples identified in the advisory include web applications, documentation systems, CI/CD pipelines, and other Markdown-rendering services.
An attacker needs the ability to submit malformed HTML-like sequences in Markdown that the application will parse. The described denial of service is remote and unauthenticated, so no account or prior access is required where untrusted Markdown can be submitted.
Yes. The vendor acknowledged the issue and fixed it in Python-Markdown 3.8.1.
Parsing the crafted Markdown can cause html.parser.HTMLParser to raise an unhandled AssertionError, crashing the application or service handling the content. Uncaught exceptions may also disclose information.