https://seclists.org/oss-sec/2026/q1/265: CVE-2025-69534 in Python-Markdown
Affected Software
Frequently Asked Questions
Which deployments are exposed to this issue?
Applications using Python-Markdown 3.8 that parse attacker-controlled or otherwise untrusted Markdown are exposed. Examples identified in the advisory include web applications, documentation systems, CI/CD pipelines, and other Markdown-rendering services.
What does an attacker need to exploit it?
An attacker needs the ability to submit malformed HTML-like sequences in Markdown that the application will parse. The described denial of service is remote and unauthenticated, so no account or prior access is required where untrusted Markdown can be submitted.
Is a fix available?
Yes. The vendor acknowledged the issue and fixed it in Python-Markdown 3.8.1.
What is the impact if the issue is triggered?
Parsing the crafted Markdown can cause html.parser.HTMLParser to raise an unhandled AssertionError, crashing the application or service handling the content. Uncaught exceptions may also disclose information.