CVE-2018-1000162

Parsedown version prior to 1.7.0 contains a Cross Site Scripting (XSS) vulnerability in `setMarkupEscaped` for escaping HTML that can result in JavaScript code execution. This attack appears to be exploitable via specially crafted markdown that allows it to side step HTML escaping by breaking AST boundaries. This vulnerability appears to have been fixed in 1.7.0 and later.

• CWE-79

• https://github.com/Roave/SecurityAdvisories/issues/44#issuecomment-368594409Third Party Advisory
• https://github.com/erusev/parsedown/pull/495Third Party Advisory
• https://github.com/Roave/SecurityAdvisories/issues/44#issuecomment-368594409Third Party Advisory
• https://github.com/erusev/parsedown/pull/495Third Party Advisory

Published

Apr 18, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-1000156GNU Patch version 2.7.6 contains an input validation vulnera…
• CVE-2018-1000157Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2018-1000158cmsmadesimple version 2.2.7 contains a Incorrect Access Cont…
• CVE-2018-1000159tlslite-ng version 0.7.3 and earlier, since commit d7b288316…
• CVE-2018-1000160RisingStack protect version 1.2.0 and earlier contains a Cro…
• CVE-2018-1000161nmap version 6.49BETA6 through 7.60, up to and including SVN…
• CVE-2018-1000163Floodlight version 1.2 and earlier contains a Cross Site Scr…
• CVE-2018-1000164gunicorn version 19.4.5 contains a CWE-113: Improper Neutral…
• CVE-2018-1000165LightSAML version prior to 1.3.5 contains a Incorrect Access…
• CVE-2018-1000166Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2018-1000167OISF suricata-update version 1.0.0a1 contains an Insecure De…
• CVE-2018-1000168nghttp2 version >= 1.10.0 and nghttp2 <= v1.31.0 contains an…7.5