PatchTheCVECVE-2018-1000874: PHP cebe markdown parser version 1.2.0 and earlier contains a Cross Site Scripting (XSS) vulnerability in all
CVE-2018-1000874 is a medium-severity flaw (CVSS 6.1) affecting markdown. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
PHP cebe markdown parser version 1.2.0 and earlier contains a Cross Site Scripting (XSS) vulnerability in all distributed parsers allowing a malicious crafted script to be executed that can result in the lose of user data and sensitive user information. This attack can be exploited by crafting a three backtick wrapped payload with a character in front: L: "```<script>alert();</script>```". NOTE: This has been argued as a non-issue (see references
Why this priority
- Public exploit reference
A fixed release or distro patch exists.
Risk facts
| CVSS score | 6.1 (Medium) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | Required |
| EPSS exploit chance | 0.8% (top 43%) |
| CISA exploited list | No |
| Weakness | CWE-79 |
| Published | 2018-12-20 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2018-1000874?
markdown: upgrade to newer than 1.2.0. Exact commands for each OS are on this page.
Is CVE-2018-1000874 being exploited?
CVE-2018-1000874 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2018-1000874 affect?
CVE-2018-1000874 affects markdown. Severity is medium (CVSS 6.1). PHP cebe markdown parser version 1.2.0 and earlier contains a Cross Site Scripting (XSS) vulnerability in all distributed parsers allowing a malicious crafted script to be executed that can result in the lose of user data and sensitive user
How urgent is CVE-2018-1000874?
Priority 40/100. Public exploit reference
Software pages
Related CVEs
- CVE-2026-40890 HIGH 7.5 UPGRADE The package `github.com/gomarkdown/markdown` is a Go library for parsing Markdown text and rendering as HTML
- CVE-2025-69534 HIGH 7.5 DOWNGRADE Python-Markdown version 3.8 contain a vulnerability where malformed HTML-like sequences can cause html.parser.
- CVE-2023-42821 HIGH 7.5 MITIGATE The package `github.com/gomarkdown/markdown` is a Go library for parsing Markdown text and rendering as HTML