CVE-2023-26303 - Vulnerability Details - OpenCVE

Denial of service could be caused to markdown-it-py, before v2.2.0, if an attacker was allowed to force null assertions with specially crafted input.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00025.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Executablebooks	Markdown-it-py

Configuration 1 [-]

cpe:2.3:a:executablebooks:markdown-it-py:*:*:*:*:*:*:*:*

No data.

No data.

Advisories

Source	ID	Title
EUVD	EUVD-2023-0131	Denial of service could be caused to markdown-it-py, before v2.2.0, if an attacker was allowed to force null assertions with specially crafted input.
Github GHSA	GHSA-vrjv-mxr7-vjf8	markdown-it-py Denial of Service vulnerability

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://github.com/executablebooks/markdown-it-py/commit/ae03c6107dfa18e648f6fdd1280f5b89092d5d49
https://nvd.nist.gov/vuln/detail/CVE-2023-26303
https://www.cve.org/CVERecord?id=CVE-2023-26303

History

Tue, 11 Mar 2025 19:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: canonical

Published: 2023-02-22T23:44:40.711Z

Updated: 2025-03-11T18:22:36.539Z

Reserved: 2023-02-21T22:36:47.685Z

Link: CVE-2023-26303

Vulnrichment

Updated: 2024-08-02T11:46:24.274Z

NVD

Status : Modified

Published: 2023-02-23T00:15:11.390

Modified: 2025-03-11T19:15:38.720

Link: CVE-2023-26303

Redhat

Severity : Moderate

Publid Date: 2023-02-23T11:32:00Z

Links: CVE-2023-26303 - Bugzilla

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-26303", "assignerOrgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc", "state": "PUBLISHED", "assignerShortName": "canonical", "dateReserved": "2023-02-21T22:36:47.685Z", "datePublished": "2023-02-22T23:44:40.711Z", "dateUpdated": "2025-03-11T18:22:36.539Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://github.com/executablebooks/markdown-it-py/releases", "defaultStatus": "unaffected", "packageName": "markdown-it-py", "platforms": ["Linux", "MacOS", "Windows"], "product": "markdown-it-py", "repo": "https://github.com/executablebooks/markdown-it-py", "vendor": "Executable Books", "versions": [{"changes": [{"at": "commit ae03c61", "status": "unaffected"}], "lessThan": "v2.2.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Mark Esler"}, {"lang": "en", "type": "remediation developer", "value": "Chris Sewell"}], "datePublic": "2023-02-22T04:56:39.000Z", "descriptions": [{"lang": "en", "value": "Denial of service could be caused to markdown-it-py, before v2.2.0, if an attacker was allowed to force null assertions with specially crafted input.\n"}], "impacts": [{"capecId": "CAPEC-267", "descriptions": [{"lang": "en", "value": "CAPEC-267"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "LOW", "baseSeverity": "LOW", "baseScore": 3.3, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"}, "format": "CVSS"}], "problemTypes": [{"descriptions": [{"cweId": "CWE-173", "description": "CWE-173", "lang": "en", "type": "CWE"}]}], "timeline": [{"lang": "en", "time": "2023-02-07T14:19:00.000-06:00", "value": "Reported to upstream."}, {"lang": "en", "time": "2023-02-22T05:56:39+01:00", "value": "Patched by upstream."}], "references": [{"tags": ["patch"], "url": "https://github.com/executablebooks/markdown-it-py/commit/ae03c6107dfa18e648f6fdd1280f5b89092d5d49"}], "title": "markdown-it-py crash on null assertions", "providerMetadata": {"orgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc", "shortName": "canonical", "dateUpdated": "2023-02-22T23:44:40.711Z"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T11:46:24.274Z"}, "title": "CVE Program Container", "references": [{"tags": ["patch", "x_transferred"], "url": "https://github.com/executablebooks/markdown-it-py/commit/ae03c6107dfa18e648f6fdd1280f5b89092d5d49"}]}, {"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-173", "lang": "en", "description": "CWE-173 Improper Handling of Alternate Encoding"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-03-11T18:22:03.295337Z", "id": "CVE-2023-26303", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-11T18:22:36.539Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://github.com/executablebooks/markdown-it-py/commit/ae03c6107dfa18e648f6fdd1280f5b89092d5d49", "tags": ["patch", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T11:46:24.274Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-26303", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-03-11T18:22:03.295337Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-173", "description": "CWE-173 Improper Handling of Alternate Encoding"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-11T18:22:25.928Z"}}], "cna": {"title": "markdown-it-py crash on null assertions", "credits": [{"lang": "en", "type": "finder", "value": "Mark Esler"}, {"lang": "en", "type": "remediation developer", "value": "Chris Sewell"}], "impacts": [{"capecId": "CAPEC-267", "descriptions": [{"lang": "en", "value": "CAPEC-267"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.3, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}], "affected": [{"repo": "https://github.com/executablebooks/markdown-it-py", "vendor": "Executable Books", "product": "markdown-it-py", "versions": [{"status": "affected", "changes": [{"at": "commit ae03c61", "status": "unaffected"}], "version": "0", "lessThan": "v2.2.0", "versionType": "semver"}], "platforms": ["Linux", "MacOS", "Windows"], "packageName": "markdown-it-py", "collectionURL": "https://github.com/executablebooks/markdown-it-py/releases", "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2023-02-07T14:19:00.000-06:00", "value": "Reported to upstream."}, {"lang": "en", "time": "2023-02-22T05:56:39+01:00", "value": "Patched by upstream."}], "datePublic": "2023-02-22T04:56:39.000Z", "references": [{"url": "https://github.com/executablebooks/markdown-it-py/commit/ae03c6107dfa18e648f6fdd1280f5b89092d5d49", "tags": ["patch"]}], "descriptions": [{"lang": "en", "value": "Denial of service could be caused to markdown-it-py, before v2.2.0, if an attacker was allowed to force null assertions with specially crafted input.\n"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-173", "description": "CWE-173"}]}], "providerMetadata": {"orgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc", "shortName": "canonical", "dateUpdated": "2023-02-22T23:44:40.711Z"}}}, "cveMetadata": {"cveId": "CVE-2023-26303", "state": "PUBLISHED", "dateUpdated": "2025-03-11T18:22:36.539Z", "dateReserved": "2023-02-21T22:36:47.685Z", "assignerOrgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc", "datePublished": "2023-02-22T23:44:40.711Z", "assignerShortName": "canonical"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:executablebooks:markdown-it-py:*:*:*:*:*:*:*:*", "matchCriteriaId": "5E45476E-D78B-486D-9B62-30E7573AAA6A", "versionEndExcluding": "2.2.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Denial of service could be caused to markdown-it-py, before v2.2.0, if an attacker was allowed to force null assertions with specially crafted input.\n"}], "id": "CVE-2023-26303", "lastModified": "2025-03-11T19:15:38.720", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 3.3, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 1.4, "source": "security@ubuntu.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-02-23T00:15:11.390", "references": [{"source": "security@ubuntu.com", "tags": ["Patch"], "url": "https://github.com/executablebooks/markdown-it-py/commit/ae03c6107dfa18e648f6fdd1280f5b89092d5d49"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://github.com/executablebooks/markdown-it-py/commit/ae03c6107dfa18e648f6fdd1280f5b89092d5d49"}], "sourceIdentifier": "security@ubuntu.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-173"}], "source": "security@ubuntu.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-173"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}