Miggo Logo
Miggo Vulnerability Database
→
CVE-2023-26302

CVE-2023-26302: markdown-it-py Denial of Service vulnerability in the command line interface

5.5

CVSS Score
3.1

Basic Information

CVE ID
CVE-2023-26302
GHSA ID
GHSA-jrwr-5x3p-hvc3
EPSS Score
0.03769%
CWE
CWE-173
Published
2/23/2023
Updated
9/30/2024
KEV Status
No
Technology
TechnologyPython

Technical Details

CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
markdown-it-pypip< 2.2.02.2.0

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from how the convert_file function handled file input. The pre-patch code used 'open(filename, "r")' without specifying encoding/error handling, making it susceptible to system-dependent encoding issues. The fix explicitly sets UTF-8 encoding with error ignoring. The added test in test_cli.py with invalid \x80 bytes confirms this was the attack vector. CWE-173 (Improper Handling of Alternate Encoding) directly maps to this missing encoding specification.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

**ni*l o* s*rvi** *oul* ** **us** to t** *omm*n* lin* int*r**** o* m*rk*own-it-py, ***or* v*.*.*, i* *n *tt**k*r w*s *llow** to us* inv*li* UT*-* ***r**t*rs *s input.

Reasoning

T** vuln*r**ility st*ms *rom *ow t** *onv*rt_*il* *un*tion **n*l** *il* input. T** pr*-p*t** *o** us** 'op*n(*il*n*m*, "r")' wit*out sp**i*yin* *n*o*in*/*rror **n*lin*, m*kin* it sus**pti*l* to syst*m-**p*n**nt *n*o*in* issu*s. T** *ix *xpli*itly s*t