CVE-2025-46656:
markdownify allows large headline prefixes such as <h9999999>, which causes memory consumption
2.9
Basic Information
Technical Details
Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
---|---|---|---|
markdownify | pip | < 0.14.1 | 0.14.1 |
Vulnerability Intelligence
Miggo AI
Root Cause Analysis
The vulnerability description states that large headline prefixes (e.g., <h9999999>) cause memory consumption. The provided commit 959561879693bf4a576f99c6733b50b01186aa08
directly addresses this issue. The diff for markdownify/__init__.py
shows modifications within the convert_hn
method of the MarkdownConverter
class. Specifically, a line n = max(1, min(6, n))
was added. This line sanitizes the input n
(the heading level), which was previously used without validation. Therefore, convert_hn
is the function that processed the unsanitized, potentially very large heading level, making it the vulnerable function prior to this patch. The full name as it would appear in a profiler would include the class and module, hence markdownify.MarkdownConverter.convert_hn
.