CVE-2023-26302

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

Denial of service could be caused to the command line interface of markdown-it-py, before v2.2.0, if an attacker was allowed to use invalid UTF-8 characters as input.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-173

Affected software

No affected versions have been published.

Timeline

Published: Feb 22, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-263035.5Denial of service could be caused to markdown-it-py, before v2.2.0, if an attacker was allowed to force null assertions with specially craft CVE-2023-263099.8A remote code execution vulnerability in the webview component of OnePlus Store app.CVE-2023-26314.3A missing permission check in Jenkins Code Dx Plugin 3.1.0 and earlier allows attackers with Overall/Read permission to connect to an attack CVE-2023-263109.8There is a command injection problem in the old version of the mobile phone backup app.CVE-2023-263119.8A remote code execution vulnerability in the webview component of OPPO Store app.CVE-2023-263148.8The mono package before 6.8.0.105+dfsg-3.3 for Debian allows arbitrary code execution because the application/x-ms-dos-executable MIME type CVE-2023-263158.8The Xiaomi router AX9000 has a post-authentication command injection vulnerability. This vulnerability is caused by the lack of input filter CVE-2023-263166.1A XSS vulnerability exists in the Xiaomi cloud service Application product. The vulnerability is caused by Webview's whitelist checking func CVE-2023-263179.8Xiaomi routers have an external interface that can lead to command injection. The vulnerability is caused by lax filtering of responses from CVE-2023-263187.2Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in Xiaomi Xiaomi Router allows Overflow Buffers.CVE-2023-263197.2Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Xiaomi Xiaomi Router allows Command Inj CVE-2023-26324.3Jenkins Code Dx Plugin 3.1.0 and earlier stores Code Dx server API keys unencrypted in job config.xml files on the Jenkins controller where