chore(deps): update dependency markdown to v3.8.1 [security]

[anaconda-renovate]

This PR contains the following updates:

Package	Update	Change	Age	Adoption	Passing	Confidence	OpenSSF
markdown (changelog)	patch	==3.8 → ==3.8.1

---

CVE-2025-69534 / GHSA-5wmx-573v-2qwq / PYSEC-2026-89

More information

Details

Python-Markdown version 3.8 contain a vulnerability where malformed HTML-like sequences can cause html.parser.HTMLParser to raise an unhandled AssertionError during Markdown parsing. Because Python-Markdown does not catch this exception, any application that processes attacker-controlled Markdown may crash. This enables remote, unauthenticated Denial of Service in web applications, documentation systems, CI/CD pipelines, and any service that renders untrusted Markdown. The issue was acknowledged by the vendor and fixed in version 3.8.1. This issue causes a remote Denial of Service in any application parsing untrusted Markdown, and can lead to Information Disclosure through uncaught exceptions.

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

• https://github.com/Python-Markdown/markdown/actions/runs/15736122892
• http://www.openwall.com/lists/oss-security/2026/03/06/4
• https://github.com/Python-Markdown/markdown/issues/1534
• https://github.com/Python-Markdown/markdown
• https://github.com/advisories/GHSA-5wmx-573v-2qwq

This data is provided by OSV and the PyPI Advisory Database (CC-BY 4.0).

---

Python-Markdown has an Uncaught Exception

CVE-2025-69534 / GHSA-5wmx-573v-2qwq / PYSEC-2026-89

More information

Details

Python-Markdown version 3.8 contain a vulnerability where malformed HTML-like sequences can cause html.parser.HTMLParser to raise an unhandled AssertionError during Markdown parsing. Because Python-Markdown does not catch this exception, any application that processes attacker-controlled Markdown may crash. This enables remote, unauthenticated Denial of Service in web applications, documentation systems, CI/CD pipelines, and any service that renders untrusted Markdown. The issue was acknowledged by the vendor and fixed in version 3.8.1. This issue causes a remote Denial of Service in any application parsing untrusted Markdown, and can lead to Information Disclosure through uncaught exceptions.

Severity

• CVSS Score: 5.5 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P

References

• https://nvd.nist.gov/vuln/detail/CVE-2025-69534
• https://github.com/Python-Markdown/markdown/issues/1534
• https://github.com/Python-Markdown/markdown/pull/1535
• https://github.com/Python-Markdown/markdown
• https://github.com/Python-Markdown/markdown/actions/runs/15736122892
• https://github.com/pypa/advisory-database/tree/main/vulns/markdown/PYSEC-2026-89.yaml
• http://www.openwall.com/lists/oss-security/2026/03/06/4

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

Python-Markdown/markdown (markdown)

v3.8.1

Compare Source

Fixed

• Ensure incomplete markup declaration in raw HTML doesn't crash parser (#​1534).
• Fixed dropped content in md_in_html (#​1526).
• Fixed HTML handling corner case that prevented some content from not being rendered (#​1528).

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.