More XSS's in safe mode

Open

#726 opened on Sep 15, 2026 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty: 4/5
Estimated time: 3-5 days
Newbie friendliness: 48/100

Issue type: Bug
Clarity: Mostly clear
Activity status: Active
Tech stack: python
Domain: security

Research direction

Start by tracing safe mode handling for HTML entities and malformed link/image syntax; reproduce the two Markdown inputs in the issue against the referenced commit. Done means both cases render as safe HTML without executable protocols or raw event-handler markup.

Written by the indexing model from the issue text.

Description

Describe the bug

After the patches of #722, I manually found a simple bypass of the HTML entity regex, and ran the fuzzer again to find another HTML corruption.

To Reproduce

The browser decodes &#058 to : forming a javascript: protocol URL (entities can be prefixed with any amount of 0's).

[Click me](javascript&#058alert(origin))

<p><a href="javascript&#058alert(origin)">Click me</a></p>

Weird combination of syntax again resulting in raw HTML being output:

<x![](`<a
>`)><svg onload=alert(origin)![](`<a
>`)

<p>&lt;x<img src="code&gt;&lt;a
&gt;&lt;/code" alt="" />&gt;<svg onload=alert(origin)<img src="code&gt;&lt;a
&gt;&lt;/code" alt="" /></p>

Expected behavior

Safe HTML is output. Maybe use a proper HTML entity decoder to solve the first.

Debug info
Version of library being used: https://github.com/trentm/python-markdown2/commit/ba92f30e9101f485bfd6b2a3178908ee4a82da9f (latest master at time of writing)

Dominant language: Python
Stars: 2.8k
Forks: 459
Avg merge: 2d 19h
Merged PRs (30d): 4

Contributor guide

No contributing guide indexed for this repository

First steps

Read the whole issue, then the project's contributing guide.
Comment on the issue to say you are picking it up — it saves two people doing the same work.
Fork the repository and make your change on a branch.
Open a pull request that references the issue number.

Similar issues

validate-structure inspecte challenge/work/.terraform et rend faux les labs qui ont un provider en cache Open

bug

Difficulty 2/5 1-3 hours Newbie friendliness 75/100

stephrobert/dsoxlab#238 · Opened Sep 24, 2026
Uniform probability densities use the upper bound as an interval width Open

Difficulty 2/5 1-3 hours Newbie friendliness 75/100

nasa/fmdtools#40 · Opened Sep 24, 2026
_common_folder() treats a single file as the common folder; single-file archives can't be installed (4.2.8) / crash (master) Open

Difficulty 2/5 1-3 hours Newbie friendliness 75/100

sublimehq/package_control#1780 · Opened Sep 24, 2026
Set 'Sample' input in 'autorun.py' to utilize 'Sample' Tab in eLog Open

Difficulty 2/5 1-3 hours Newbie friendliness 65/100

pcdshub/mfx#309 · 2 comments · Opened Sep 24, 2026
niri config file addition does not respect existing optional include Open

Difficulty 2/5 1-3 hours Newbie friendliness 70/100

nwg-piotr/nwg-displays#145 · Opened Sep 24, 2026

More Python issues