PyPI / markdown-it-py / 4.2.0

markdown-it-py 4.2.0

Source

https://github.com/executablebooks/markdown-it-py

Tag scanned

v4.2.0

Compared with

v4.1.0 (0 signals introduced since)

Files

154 scanned, 12 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 12 info

Scan time

6.2 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 11 of 11 warn and critical signals; 11 demoted to info.

Disclude version

4.0.0

Scanned (UTC)

2026-10-14 18:17

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info warn → info by review narrow-file-charset benchmarking/samples/block-ref-nested.md:1:1

   file uses only 9 distinct printable characters ("*:[]abfor") — JSF*ck-style or character-constrained obfuscation (raw pass, confidence 0.90)

   [[[[[[[foo]]]]]]]
   
   [[[[[[[foo]]]]]]]: bar

   likely benign LLM, confidence 0.85 Markdown sample testing nested reference-link brackets.

   Reasoning

   A markdown file with nested brackets and a reference definition uses a small character set naturally because it is a bracket-syntax test sample for nested link references; not obfuscation.

2. info critical → info by review path-command-shadow docs/contributing.md:70:1

   [embedded bash] redirect writes to `python` — filename matches a system command (PATH hijack setup) (ast pass, confidence 0.88)

   >> cd markdown-it-py
   >> python tests/test_cmark_spec/get_cmark_spec.py

   likely benign LLM, confidence 0.80 Contributor docs showing how to run a Python script in a cloned repo.

   Reasoning

   The AST pass flags a redirect target named python, but the snippet is a documentation example of running a script via python after cd into a directory; the shell-prompt '>>' markers suggest a doc snippet. The path-shadow pattern does not match an actual hijack setup here.

3. info warn → info by review unicode-mixed-script tests/test_port/fixtures/commonmark_extras.md:33:23

   identifier `θωkå` mixes scripts: Greek + Latin (raw pass, confidence 0.80)

   
   Reference labels: 'i̇θωkå'.toUpperCase() is 'İΘΩKÅ', but these should still be equivalent
   .
   [İϴΩKÅ]

   likely benign LLM, confidence 0.90 Test fixture for Unicode reference-label case-folding equivalence.

   Reasoning

   This is a CommonMark conformance fixture deliberately testing Unicode case folding of reference labels (Turkish dotted i, Greek, Angstrom sign). Mixed scripts are intentional test data.

4. info warn → info by review unicode-mixed-script tests/test_port/fixtures/commonmark_extras.md:33:53

   identifier `ΘΩKÅ` mixes scripts: Greek + Latin (raw pass, confidence 0.80)

   
   Reference labels: 'i̇θωkå'.toUpperCase() is 'İΘΩKÅ', but these should still be equivalent
   .
   [İϴΩKÅ]

   likely benign LLM, confidence 0.90 Test fixture for Unicode reference-label case-folding equivalence.

   Reasoning

   Same intentional CommonMark case-folding test fixture; the mixed Greek/Latin identifiers are the point of the test.

5. info warn → info by review unicode-mixed-script tests/test_port/fixtures/commonmark_extras.md:35:2

   identifier `İϴΩKÅ` mixes scripts: Latin + Greek + Other (raw pass, confidence 0.80)

   .
   [İϴΩKÅ]
   
   [i̇θωkå]: /url

   likely benign LLM, confidence 0.90 Test fixture reference label with mixed-script characters.

   Reasoning

   Deliberate Unicode label test in a conformance fixture; no executable context.

6. info warn → info by review unicode-mixed-script tests/test_port/fixtures/commonmark_extras.md:37:5

   identifier `θωkå` mixes scripts: Greek + Latin (raw pass, confidence 0.80)

   
   [i̇θωkå]: /url
   .
   <p><a href="/url">İϴΩKÅ</a></p>

   likely benign LLM, confidence 0.90 Test fixture reference definition with mixed-script characters.

   Reasoning

   Intentional mixed-script reference definition in a conformance test fixture.

7. info warn → info by review unicode-mixed-script tests/test_port/fixtures/commonmark_extras.md:39:19

   identifier `İϴΩKÅ` mixes scripts: Latin + Greek + Other (raw pass, confidence 0.80)

   .
   <p><a href="/url">İϴΩKÅ</a></p>
   .

   likely benign LLM, confidence 0.90 Test fixture expected output with mixed-script link text.

   Reasoning

   Expected HTML output in a conformance fixture containing mixed-script link text; benign test data.

8. info long-line tests/test_port/fixtures/linkify.md:240:1

   line length 584 characters (raw pass, confidence 0.50)

   <p>This applies to <em>series of URLs too</em> <a href="http://example.org/foo._bar_-_baz">http://example.org/foo._bar_-_baz</a> <a href="http://example.org/foo._bar_-_baz">http://example.org/foo._bar_-_baz</a>, these dont <a href="http://example.org/foo._bar_-_baz">http://example.org/foo._bar_-_baz</a> <a href="http:/

9. info warn → info by review unicode-homoglyph tests/test_port/fixtures/normalize.md:5:21

   identifier `α` contains homoglyph candidates: α (03B1)→a (raw pass, confidence 0.70)

   .
   <http://example.com/α%CE%B2γ%CE%B4>
   .
   <p><a href="http://example.com/%CE%B1%CE%B2%CE%B3%CE%B4">http://example.com/αβγδ</a></p>

   likely benign LLM, confidence 0.90 Test fixture for URL normalization with Greek characters.

   Reasoning

   Normalization test fixture for URL percent-encoding of Greek characters; the homoglyph flag is a false positive on intentional test data.

10. info warn → info by review unicode-mixed-script tests/test_port/fixtures/normalize.md:5:27

    identifier `B2γ` mixes scripts: Latin + Greek (raw pass, confidence 0.80)

    .
    <http://example.com/α%CE%B2γ%CE%B4>
    .
    <p><a href="http://example.com/%CE%B1%CE%B2%CE%B3%CE%B4">http://example.com/αβγδ</a></p>

    likely benign LLM, confidence 0.90 Test fixture URL containing mixed Greek and Latin characters.

    Reasoning

    Intentional Greek/Latin mix in a URL normalization conformance fixture.

11. info warn → info by review unicode-homoglyph tests/test_port/fixtures/normalize.md:11:26

    identifier `α` contains homoglyph candidates: α (03B1)→a (raw pass, confidence 0.70)

    .
    [foo](http://example.com/α%CE%B2γ%CE%B4)
    .
    <p><a href="http://example.com/%CE%B1%CE%B2%CE%B3%CE%B4">foo</a></p>

    likely benign LLM, confidence 0.90 Test fixture link with Greek characters in URL.

    Reasoning

    Same normalization test fixture; homoglyph flag is a false positive on deliberate test input.

12. info warn → info by review unicode-mixed-script tests/test_port/fixtures/normalize.md:11:32

    identifier `B2γ` mixes scripts: Latin + Greek (raw pass, confidence 0.80)

    .
    [foo](http://example.com/α%CE%B2γ%CE%B4)
    .
    <p><a href="http://example.com/%CE%B1%CE%B2%CE%B3%CE%B4">foo</a></p>

    likely benign LLM, confidence 0.90 Test fixture link with mixed Latin and Greek URL characters.

    Reasoning

    Intentional mixed-script URL in a markdown normalization test fixture.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/executablebooks/markdown-it-py markdown-it-py && cd markdown-it-py
git checkout v4.2.0
disclude scan --severity info --diff v4.1.0 .