disclude.io

PyPI / markdown-it-py / 4.2.0

markdown-it-py 4.2.0

Source
https://github.com/executablebooks/markdown-it-py
Tag scanned
v4.2.0
Compared with
v4.1.0 (0 signals introduced since)
Files
155 scanned, 11 skipped (binary, oversized, or unrecognised)
Signals
0 critical · 0 warn · 12 info
Scan time
7.0 s
LLM review
Reviewed by claude-haiku-5-5 (Anthropic): 11 of 11 warn and critical signals; 11 demoted to info.
Disclude version
4.1.0
Scanned (UTC)
2026-10-21 22:40

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

  1. info warn → info by review narrow-file-charset benchmarking/samples/block-ref-nested.md:1:1

    file uses only 9 distinct printable characters ("*:[]abfor") — JSF*ck-style or character-constrained obfuscation (raw pass, confidence 0.90)

    [[[[[[[foo]]]]]]]

[[[[[[[foo]]]]]]]: bar
    likely benign LLM, confidence 0.93 Small markdown sample with nested bracket reference syntax.
    Reasoning

    A markdown file with nested brackets and a reference definition is a normal CommonMark test/sample construct; the narrow charset is an artifact of the tiny file content, not obfuscation.

  2. info critical → info by review path-command-shadow docs/contributing.md:70:1

    [embedded bash] redirect writes to `python` — filename matches a system command (PATH hijack setup) (ast pass, confidence 0.88)

    >> cd markdown-it-py
>> python tests/test_cmark_spec/get_cmark_spec.py
    likely benign LLM, confidence 0.85 Contributor doc showing how to run a Python test-spec script.
    Reasoning

    The embedded bash shows changing into a directory and running a Python script named get_cmark_spec.py; the python filename is an interpreter invocation in a docs example, not a redirect writing a file named python. The PATH-hijack reading is a false match from the shell-redirect parse.

  3. info warn → info by review unicode-mixed-script tests/test_port/fixtures/commonmark_extras.md:33:23

    identifier `θωkå` mixes scripts: Greek + Latin (raw pass, confidence 0.80)

    
Reference labels: 'i̇θωkå'.toUpperCase() is 'İΘΩKÅ', but these should still be equivalent
.
[İϴΩKÅ]
    likely benign LLM, confidence 0.90 Unicode case-folding test fixture for reference link labels.
    Reasoning

    This is a CommonMark conformance fixture deliberately testing Unicode case folding of reference labels (Turkish dotted i, Greek, Å); mixed scripts are intentional test data.

  4. info warn → info by review unicode-mixed-script tests/test_port/fixtures/commonmark_extras.md:33:53

    identifier `ΘΩKÅ` mixes scripts: Greek + Latin (raw pass, confidence 0.80)

    
Reference labels: 'i̇θωkå'.toUpperCase() is 'İΘΩKÅ', but these should still be equivalent
.
[İϴΩKÅ]
    likely benign LLM, confidence 0.90 Unicode case-folding test fixture for reference link labels.
    Reasoning

    Same intentional Unicode label-equivalence test fixture from the CommonMark extras suite.

  5. info warn → info by review unicode-mixed-script tests/test_port/fixtures/commonmark_extras.md:35:2

    identifier `İϴΩKÅ` mixes scripts: Latin + Greek + Other (raw pass, confidence 0.80)

    .
[İϴΩKÅ]

[i̇θωkå]: /url
    likely benign LLM, confidence 0.90 Unicode reference label in a markdown test fixture.
    Reasoning

    Deliberate mixed-script reference label used to test normalization in a markdown conformance fixture.

  6. info warn → info by review unicode-mixed-script tests/test_port/fixtures/commonmark_extras.md:37:5

    identifier `θωkå` mixes scripts: Greek + Latin (raw pass, confidence 0.80)

    
[i̇θωkå]: /url
.
<p><a href="/url">İϴΩKÅ</a></p>
    likely benign LLM, confidence 0.90 Unicode reference label in a markdown test fixture.
    Reasoning

    Deliberate Unicode label used to test case-insensitive reference matching; it is expected test content.

  7. info warn → info by review unicode-mixed-script tests/test_port/fixtures/commonmark_extras.md:39:19

    identifier `İϴΩKÅ` mixes scripts: Latin + Greek + Other (raw pass, confidence 0.80)

    .
<p><a href="/url">İϴΩKÅ</a></p>
.
    likely benign LLM, confidence 0.90 Expected-output line in a markdown test fixture.
    Reasoning

    Expected HTML output in a conformance fixture showing the Unicode link text; no executable payload.

  8. info long-line tests/test_port/fixtures/linkify.md:240:1

    line length 584 characters (raw pass, confidence 0.50)

    <p>This applies to <em>series of URLs too</em> <a href="http://example.org/foo._bar_-_baz">http://example.org/foo._bar_-_baz</a> <a href="http://example.org/foo._bar_-_baz">http://example.org/foo._bar_-_baz</a>, these dont <a href="http://example.org/foo._bar_-_baz">http://example.org/foo._bar_-_baz</a> <a href="http:/
  9. info warn → info by review unicode-homoglyph tests/test_port/fixtures/normalize.md:5:21

    identifier `α` contains homoglyph candidates: α (03B1)→a (raw pass, confidence 0.70)

    .
<http://example.com/α%CE%B2γ%CE%B4>
.
<p><a href="http://example.com/%CE%B1%CE%B2%CE%B3%CE%B4">http://example.com/αβγδ</a></p>
    likely benign LLM, confidence 0.90 Greek characters in a URL normalization test fixture.
    Reasoning

    Normalization test fixture for URL percent-encoding of Greek characters; the Greek alpha is intended test content, not a homoglyph attack.

  10. info warn → info by review unicode-mixed-script tests/test_port/fixtures/normalize.md:5:27

    identifier `B2γ` mixes scripts: Latin + Greek (raw pass, confidence 0.80)

    .
<http://example.com/α%CE%B2γ%CE%B4>
.
<p><a href="http://example.com/%CE%B1%CE%B2%CE%B3%CE%B4">http://example.com/αβγδ</a></p>
    likely benign LLM, confidence 0.90 Mixed-script URL in a markdown normalization test.
    Reasoning

    Intentional mixed Greek/Latin URL in a normalization test fixture checking percent-encoding behavior.

  11. info warn → info by review unicode-homoglyph tests/test_port/fixtures/normalize.md:11:26

    identifier `α` contains homoglyph candidates: α (03B1)→a (raw pass, confidence 0.70)

    .
[foo](http://example.com/α%CE%B2γ%CE%B4)
.
<p><a href="http://example.com/%CE%B1%CE%B2%CE%B3%CE%B4">foo</a></p>
    likely benign LLM, confidence 0.90 Greek characters in a link URL inside a normalization test fixture.
    Reasoning

    Same deliberate normalization test content as the other fixture lines; the link is to example.com with expected HTML output.

  12. info warn → info by review unicode-mixed-script tests/test_port/fixtures/normalize.md:11:32

    identifier `B2γ` mixes scripts: Latin + Greek (raw pass, confidence 0.80)

    .
[foo](http://example.com/α%CE%B2γ%CE%B4)
.
<p><a href="http://example.com/%CE%B1%CE%B2%CE%B3%CE%B4">foo</a></p>
    likely benign LLM, confidence 0.90 Mixed-script link URL in a markdown normalization test.
    Reasoning

    Intentional mixed-script link URL in a conformance fixture; no malicious behavior.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.1.0
git clone https://github.com/executablebooks/markdown-it-py markdown-it-py && cd markdown-it-py
git checkout v4.2.0
disclude scan --severity info --diff v4.1.0 .