markdown 3.11.2

Source: https://github.com/Python-Markdown/markdown
Tag scanned: 3.11.2
Compared with: 3.11.1 (0 signals introduced since)
Files: 292 scanned, 152 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 15 info
Scan time: 8.7 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 15 of 15 warn and critical signals; 15 demoted to info.
Disclude version: 4.0.0
Scanned (UTC): 2026-10-20 05:10

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review frame-introspection markdown/util.py:169:13

`sys._getframe` — call-stack frame introspection (ast pass, confidence 0.70)
```
    """
    frame = sys._getframe(size)

    for size in count(size):
```
likely benign LLM, confidence 0.85 Calls sys._getframe(size) to walk the call stack inside the markdown utility module.
Reasoning
sys._getframe in a Python-Markdown utility is a common, legitimate use for stack introspection in helper code (e.g., the count/size loop suggests frame-depth lookup). Not obfuscation or malicious intent on its own.
info ~~warn~~ → info by review unicode-zero-width tests/misc/bidi.txt:14:35

U+200C ZERO WIDTH NON-JOINER in source (raw pass, confidence 0.75)
```
پایتون زبان برنامه⟨U+200C⟩نویسی تفسیری و سطح بالا ، شی⟨U+200C⟩گرا و یک زبان برنامه⟨U+200C⟩نویسی تفسیری سمت سرور قدرتمند است که توسط گیدو ون روسوم در سال ۱۹۹۰ ساخته شد. این زبان در ویژگی⟨U+200C⟩ها شبیه پر
```
dismissed LLM, confidence 0.90 Persian text containing legitimate zero-width non-joiners used in standard orthography.
Reasoning
ZWNJ characters in Persian prose are the normal orthography for words like 'برنامه⟨U+200C⟩نویسی'; this is a text test fixture for bidi/unicode handling, not code.

info ~~warn~~ → info by review unicode-zero-width tests/misc/bidi.txt:14:88

U+200C ZERO WIDTH NON-JOINER in source (raw pass, confidence 0.75)

 تفسیری و سطح بالا ، شی⟨U+200C⟩گرا و یک زبان برنامه⟨U+200C⟩نویسی تفسیری سمت سرور قدرتمند است که توسط گیدو ون روسوم در سال ۱۹۹۰ ساخته شد. این زبان در ویژگی⟨U+200C⟩ها شبیه پرل، روبی، اسکیم، اسمال⟨U+200C⟩تا… (340 bytes total)

dismissed LLM, confidence 0.90 Persian prose with ZWNJ in a unicode test fixture.

Reasoning

Same Persian prose fixture; ZWNJ is standard in words like 'شی⟨U+200C⟩گرا'. Test data for unicode handling.

info ~~warn~~ → info by review unicode-zero-width tests/misc/bidi.txt:14:127

U+200C ZERO WIDTH NON-JOINER in source (raw pass, confidence 0.75)

�⟨U+200C⟩گرا و یک زبان برنامه⟨U+200C⟩نویسی تفسیری سمت سرور قدرتمند است که توسط گیدو ون روسوم در سال ۱۹۹۰ ساخته شد. این زبان در ویژگی⟨U+200C⟩ها شبیه پرل، روبی، اسکیم، اسمال⟨U+200C⟩تاک و تی⟨U+200C⟩سی⟨U+200C⟩ال است و ا… (340 bytes total)

dismissed LLM, confidence 0.90 Persian prose with ZWNJ in a unicode test fixture.

Reasoning

Same Persian prose fixture with normal ZWNJ orthography; not executable code.

info ~~warn~~ → info by review unicode-zero-width tests/misc/bidi.txt:14:300

U+200C ZERO WIDTH NON-JOINER in source (raw pass, confidence 0.75)
```
ه شد. این زبان در ویژگی⟨U+200C⟩ها شبیه پرل، روبی، اسکیم، اسمال⟨U+200C⟩تاک و تی⟨U+200C⟩سی⟨U+200C⟩ال است و از مدیریت خودکار حافظه استفاده می⟨U+200C⟩کند
```
dismissed LLM, confidence 0.90 Persian text fragment with ZWNJ in a unicode test fixture.
Reasoning
Persian text with ZWNJ in 'می⟨U+200C⟩کند', standard orthography in a test fixture.
info ~~warn~~ → info by review unicode-zero-width tests/misc/bidi.txt:14:360

U+200C ZERO WIDTH NON-JOINER in source (raw pass, confidence 0.75)
```
�ل، روبی، اسکیم، اسمال⟨U+200C⟩تاک و تی⟨U+200C⟩سی⟨U+200C⟩ال است و از مدیریت خودکار حافظه استفاده می⟨U+200C⟩کند
```
dismissed LLM, confidence 0.90 Persian text fragment with ZWNJ in a unicode test fixture.
Reasoning
Persian text with ZWNJ in standard orthography; test fixture content.
info ~~warn~~ → info by review unicode-zero-width tests/misc/bidi.txt:14:377

U+200C ZERO WIDTH NON-JOINER in source (raw pass, confidence 0.75)
```
اسکیم، اسمال⟨U+200C⟩تاک و تی⟨U+200C⟩سی⟨U+200C⟩ال است و از مدیریت خودکار حافظه استفاده می⟨U+200C⟩کند
```
dismissed LLM, confidence 0.90 Persian text fragment with ZWNJ in a unicode test fixture.
Reasoning
Persian text with ZWNJ in standard orthography; test fixture content.
info ~~warn~~ → info by review unicode-zero-width tests/misc/bidi.txt:14:384

U+200C ZERO WIDTH NON-JOINER in source (raw pass, confidence 0.75)
```
�م، اسمال⟨U+200C⟩تاک و تی⟨U+200C⟩سی⟨U+200C⟩ال است و از مدیریت خودکار حافظه استفاده می⟨U+200C⟩کند
```
dismissed LLM, confidence 0.90 Persian text fragment with ZWNJ in a unicode test fixture.
Reasoning
Persian text with ZWNJ in standard orthography; test fixture content.
info ~~warn~~ → info by review unicode-zero-width tests/misc/bidi.txt:14:463

U+200C ZERO WIDTH NON-JOINER in source (raw pass, confidence 0.75)
```
�دکار حافظه استفاده می⟨U+200C⟩کند
```
dismissed LLM, confidence 0.90 Persian text fragment with ZWNJ in a unicode test fixture.
Reasoning
Persian text with ZWNJ in standard orthography; test fixture content.
info ~~warn~~ → info by review unicode-homoglyph tests/misc/bidi.txt:64:446

identifier `В` contains homoglyph candidates: В (0412)→B (raw pass, confidence 0.70)
```
в морали Спрингфилда. В эпизоде «Alone Again, Natura-Diddily»  он овдовел, его жена Мод погибла в результате несчастного случая. 
```
dismissed LLM, confidence 0.90 Cyrillic 'В' in Russian prose within a unicode test fixture.
Reasoning
Cyrillic prose in a Russian Simpsons article fixture; the homoglyph flag is triggered by ordinary Cyrillic letters in running text, not an identifier used in code.
info ~~warn~~ → info by review unicode-homoglyph tests/misc/bidi.txt:66:180

identifier `с` contains homoglyph candidates: с (0441)→c (raw pass, confidence 0.70)
```
ьи Симпсонов. Начиная с первых серий, он регулярно появляется в «Симпсонах». Считается, что Нед Фландерс был назван в честь улицы *Northeast Flanders St.* в [Портленде](http://www.portland.gov), Орег… (340 bytes total)
```
dismissed LLM, confidence 0.90 Cyrillic 'с' in Russian prose within a unicode test fixture.
Reasoning
Cyrillic word 'с' is a normal Russian preposition in prose; the homoglyph detector fires on natural-language text in a fixture file.
info ~~warn~~ → info by review narrow-file-charset tests/misc/bracket_re.txt:1:1

file uses only 2 distinct printable characters ("[x") — JSF*ck-style or character-constrained obfuscation (raw pass, confidence 0.90)
```
[x
xxx xxx xxx xxx xxx xxx xxx xxx
```
likely benign LLM, confidence 0.80 Small text file of bracket and x characters, apparently a regex test fixture.
Reasoning
The file is a test fixture for bracket regex handling, consisting of '[x' and 'xxx' tokens. It is plausibly a test input, though a JSFuck-like payload cannot be fully ruled out from a short snippet.
info ~~warn~~ → info by review whitespace-anomaly tests/test_syntax/extensions/test_tables.py:32:1

invisible whitespace U+00A0 in indentation (raw pass, confidence 0.80)
```
        text = """
⟨U+00A0⟩  | Second Header
------------- | -------------
⟨U+00A0⟩  | Content Cell
```
likely benign LLM, confidence 0.90 Non-breaking spaces in a markdown table string inside a test file.
Reasoning
Non-breaking spaces inside a multi-line markdown table test string literal are intentional test input for table parsing edge cases, not code obfuscation.
info ~~warn~~ → info by review whitespace-anomaly tests/test_syntax/extensions/test_tables.py:34:1

invisible whitespace U+00A0 in indentation (raw pass, confidence 0.80)
```
------------- | -------------
⟨U+00A0⟩  | Content Cell
Content Cell  | ⟨U+00A0⟩
"""
```
likely benign LLM, confidence 0.90 Non-breaking spaces in a markdown table string inside a test file.
Reasoning
Same as the adjacent finding: NBSP characters within a markdown table test literal, deliberate test data.
info ~~warn~~ → info by review dynamic-execution tools/superfences_formaters.py:113:13

`exec` called on a non-literal expression (ast pass, confidence 0.70)
```
        try:
            exec(source, self.globals, self.locals)
        except KeyboardInterrupt:
            sys.stdout.close()
```
likely benign LLM, confidence 0.80 exec runs a code-block source string in a formatter used by the docs tooling.
Reasoning
exec on a source string with globals/locals in a superfences formatter is the documented mechanism for executing user-authored code blocks in docs tooling. It is dynamic execution, but in a build tool operating on repository content, not an encoded dropper.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/Python-Markdown/markdown markdown && cd markdown
git checkout 3.11.2
disclude scan --severity info --diff 3.11.1 .