-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| markdownify | pip | < 0.14.1 | 0.14.1 |
Miggo AIRoot Cause AnalysisThe vulnerability description states that large headline prefixes (e.g., <h9999999>) cause memory consumption. The provided commit 959561879693bf4a576f99c6733b50b01186aa08 directly addresses this issue. The diff for markdownify/__init__.py shows modifications within the convert_hn method of the MarkdownConverter class. Specifically, a line n = max(1, min(6, n)) was added. This line sanitizes the input n (the heading level), which was previously used without validation. Therefore, convert_hn is the function that processed the unsanitized, potentially very large heading level, making it the vulnerable function prior to this patch. The full name as it would appear in a profiler would include the class and module, hence markdownify.MarkdownConverter.convert_hn.
PythonPythonKEV Misses 88% of Exploited CVEs- Get the report