markdown-it-py Denial of Service vulnerability

MEDIUM 5.5CVE-2023-26303 · GHSA-vrjv-mxr7-vjf8 · PYSEC-2023-24 · Published 23/02/2023 · updated 17/06/2026

In short

CVE-2023-26303 is a MEDIUM (CVSS 5.5) vulnerability affecting markdown-it-py, markdown-it-py (executablebooks).
Chance of exploitation in the next 30 days (EPSS): 0.22%, higher than 13.3% of all vulnerabilities.
Fix: update to 2.2.0 or later.

Package	Affected versions	Patched versions
markdown-it-py PyPI	`< 2.2.0`	`2.2.0`
markdown-it-py executablebooks	`< 2.2.0`	`2.2.0`

Denial of service could be caused to markdown-it-py, before v2.2.0, if an attacker was allowed to force null assertions with specially crafted input.

NVD description

Denial of service could be caused to markdown-it-py, before v2.2.0, if an attacker was allowed to force null assertions with specially crafted input.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.