CVE-2020-11888

Name of the Vulnerable Software and Affected Versions python-markdown2 versions 2.3.8 and earlier

Description The issue arises from the mishandling of element names, which can lead to XSS attacks unless a w+ match succeeds. An example of a potential attack involves using element names with special characters, such as elementname@ or elementname-, in combination with an onclick attribute.

Recommendations For python-markdown2 versions 2.3.8 and earlier, update to a version that properly handles element names to prevent XSS attacks.