markdown 3.11.2

Source: https://github.com/Python-Markdown/markdown
Tag scanned: 3.11.2
Compared with: 3.11.1 (0 signals introduced since)
Files: 438 scanned, 6 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 28 info
Scan time: 17.1 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 27 of 27 warn and critical signals; 27 demoted to info.
Disclude version: 4.1.0
Scanned (UTC): 2026-10-22 07:33

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review hidden-llm-instruction docs/change_log/index.md:162:30

AI-directed instruction in a Markdown comment, which the page does not render (ast pass, confidence 0.75)
```
@address.com>` problem (Tracker #1501354).

May 18, 2006: Stopped catching unquoted titles in reference links.
Stopped creating blank headers.

May 15, 2006: A bug with lists, recursion on block-level elements,
run-in headers, spaces before headers, Unicode input (thanks to Aaron
Swartz). Sourceforge tracker #s: 148931… (342 bytes total)
```
likely benign LLM, confidence 0.85 Changelog entry text in a Markdown docs file describing past bug fixes.
Reasoning
The snippet is ordinary historical changelog prose about Markdown library bugs and tracker numbers; nothing in it addresses an AI or tries to steer a model. The flag appears to be a false positive triggered by the comment context.
info ~~warn~~ → info by review frame-introspection markdown/util.py:169:13

`sys._getframe` — call-stack frame introspection (ast pass, confidence 0.70)
```
    """
    frame = sys._getframe(size)

    for size in count(size):
```
likely benign LLM, confidence 0.90 Call to sys._getframe in the Markdown library utility code.
Reasoning
sys._getframe is used in the Python-Markdown library's util module inside a helper that inspects caller frames for a stack-depth-based feature. Frame introspection is a common legitimate pattern in libraries; no dynamic execution or exfiltration is shown.
info ~~warn~~ → info by review unicode-zero-width tests/misc/bidi.html:5:38

U+200C ZERO WIDTH NON-JOINER in source (raw pass, confidence 0.75)
```
پایتون زبان برنامه⟨U+200C⟩نویسی تفسیری و سطح بالا ، شی⟨U+200C⟩گرا و یک زبان برنامه⟨U+200C⟩نویسی تفسیری سمت سرور قدرتمند است که توسط گیدو ون روسوم در سال ۱۹۹۰ ساخته شد. این زبان در ویژگی⟨U+200C⟩ها شبیه … (340 bytes total)
```
likely benign LLM, confidence 0.93 Persian paragraph in a bidi test page with natural ZWNJ joiners.
Reasoning
Persian text in a bidi test fixture contains ZWNJ characters, which are correct and expected in Persian orthography (e.g. برنامه⟨U+200C⟩نویسی). This is a legitimate linguistic use within a test file.

info ~~warn~~ → info by review unicode-zero-width tests/misc/bidi.html:5:91

U+200C ZERO WIDTH NON-JOINER in source (raw pass, confidence 0.75)

 تفسیری و سطح بالا ، شی⟨U+200C⟩گرا و یک زبان برنامه⟨U+200C⟩نویسی تفسیری سمت سرور قدرتمند است که توسط گیدو ون روسوم در سال ۱۹۹۰ ساخته شد. این زبان در ویژگی⟨U+200C⟩ها شبیه پرل، روبی، اسکیم، اسمال⟨U+200C⟩تا… (340 bytes total)

likely benign LLM, confidence 0.93 Persian text with ZWNJ in a bidi test fixture.

Reasoning

Same Persian test paragraph; ZWNJ occurrences are standard in written Persian and the file is a bidi/unicode test fixture.

info ~~warn~~ → info by review unicode-zero-width tests/misc/bidi.html:5:130

U+200C ZERO WIDTH NON-JOINER in source (raw pass, confidence 0.75)

�⟨U+200C⟩گرا و یک زبان برنامه⟨U+200C⟩نویسی تفسیری سمت سرور قدرتمند است که توسط گیدو ون روسوم در سال ۱۹۹۰ ساخته شد. این زبان در ویژگی⟨U+200C⟩ها شبیه پرل، روبی، اسکیم، اسمال⟨U+200C⟩تاک و تی⟨U+200C⟩سی⟨U+200C⟩ال است و ا… (340 bytes total)

likely benign LLM, confidence 0.93 Persian text with ZWNJ in a bidi test fixture.

Reasoning

Persian ZWNJ usage inside a unicode test fixture is linguistically required rather than hidden content.

info ~~warn~~ → info by review unicode-zero-width tests/misc/bidi.html:5:303

U+200C ZERO WIDTH NON-JOINER in source (raw pass, confidence 0.75)
```
ه شد. این زبان در ویژگی⟨U+200C⟩ها شبیه پرل، روبی، اسکیم، اسمال⟨U+200C⟩تاک و تی⟨U+200C⟩سی⟨U+200C⟩ال است و از مدیریت خودکار حافظه استفاده می⟨U+200C⟩کند
```
likely benign LLM, confidence 0.93 Persian text fragment with ZWNJ in a test HTML file.
Reasoning
Persian ZWNJ in a legitimate test paragraph; no code execution or concealment involved.
info ~~warn~~ → info by review unicode-zero-width tests/misc/bidi.html:5:363

U+200C ZERO WIDTH NON-JOINER in source (raw pass, confidence 0.75)
```
�ل، روبی، اسکیم، اسمال⟨U+200C⟩تاک و تی⟨U+200C⟩سی⟨U+200C⟩ال است و از مدیریت خودکار حافظه استفاده می⟨U+200C⟩کند
```
likely benign LLM, confidence 0.93 Persian text fragment with ZWNJ in a test HTML file.
Reasoning
Standard Persian orthography with ZWNJ in a unicode test fixture.
info ~~warn~~ → info by review unicode-zero-width tests/misc/bidi.html:5:380

U+200C ZERO WIDTH NON-JOINER in source (raw pass, confidence 0.75)
```
اسکیم، اسمال⟨U+200C⟩تاک و تی⟨U+200C⟩سی⟨U+200C⟩ال است و از مدیریت خودکار حافظه استفاده می⟨U+200C⟩کند
```
likely benign LLM, confidence 0.93 Persian text fragment with ZWNJ in a test HTML file.
Reasoning
Standard Persian ZWNJ usage in a bidi test fixture.
info ~~warn~~ → info by review unicode-zero-width tests/misc/bidi.html:5:387

U+200C ZERO WIDTH NON-JOINER in source (raw pass, confidence 0.75)
```
�م، اسمال⟨U+200C⟩تاک و تی⟨U+200C⟩سی⟨U+200C⟩ال است و از مدیریت خودکار حافظه استفاده می⟨U+200C⟩کند
```
likely benign LLM, confidence 0.93 Persian text fragment with ZWNJ in a test HTML file.
Reasoning
Standard Persian ZWNJ usage in a bidi test fixture.
info ~~warn~~ → info by review unicode-zero-width tests/misc/bidi.html:5:466

U+200C ZERO WIDTH NON-JOINER in source (raw pass, confidence 0.75)
```
�دکار حافظه استفاده می⟨U+200C⟩کند
```
likely benign LLM, confidence 0.93 Persian text fragment with ZWNJ in a test HTML file.
Reasoning
Standard Persian ZWNJ usage in a bidi test fixture.
info ~~warn~~ → info by review unicode-homoglyph tests/misc/bidi.html:38:462

identifier `В` contains homoglyph candidates: В (0412)→B (raw pass, confidence 0.70)
```
в морали Спрингфилда. В эпизоде «Alone Again, Natura-Diddily» он овдовел, его жена Мод погибла в результате несчастного случая. 
```
likely benign LLM, confidence 0.90 Cyrillic word in Russian prose in a bidi test fixture.
Reasoning
The flagged identifier is a Cyrillic capital V inside Russian prose describing The Simpsons, not a code identifier. Cyrillic text is legitimate in a multilingual test page.
info ~~warn~~ → info by review unicode-homoglyph tests/misc/bidi.html:39:183

identifier `с` contains homoglyph candidates: с (0441)→c (raw pass, confidence 0.70)
```
ьи Симпсонов. Начиная с первых серий, он регулярно появляется в «Симпсонах». Считается, что Нед Фландерс был назван в честь улицы Northeast Flanders St. в <a href="http://www.portland.gov">Портлен… (340 bytes total)
```
likely benign LLM, confidence 0.90 Cyrillic word in Russian prose in a bidi test fixture.
Reasoning
The Cyrillic letter in the Russian sentence is ordinary natural-language text in a multilingual test file, not an identifier used for spoofing.

info ~~warn~~ → info by review unicode-zero-width tests/misc/bidi.txt:14:35

U+200C ZERO WIDTH NON-JOINER in source (raw pass, confidence 0.75)

پایتون زبان برنامه⟨U+200C⟩نویسی تفسیری و سطح بالا ، شی⟨U+200C⟩گرا و یک زبان برنامه⟨U+200C⟩نویسی تفسیری سمت سرور قدرتمند است که توسط گیدو ون روسوم در سال ۱۹۹۰ ساخته شد. این زبان در ویژگی⟨U+200C⟩ها شبیه پر

likely benign LLM, confidence 0.90 Persian text with ZWNJ in a text test file.

Reasoning

Persian text with ZWNJ in a plain-text bidi test fixture; this is standard orthography and the file is clearly a unicode test corpus.

info ~~warn~~ → info by review unicode-zero-width tests/misc/bidi.txt:14:88

U+200C ZERO WIDTH NON-JOINER in source (raw pass, confidence 0.75)

 تفسیری و سطح بالا ، شی⟨U+200C⟩گرا و یک زبان برنامه⟨U+200C⟩نویسی تفسیری سمت سرور قدرتمند است که توسط گیدو ون روسوم در سال ۱۹۹۰ ساخته شد. این زبان در ویژگی⟨U+200C⟩ها شبیه پرل، روبی، اسکیم، اسمال⟨U+200C⟩تا… (340 bytes total)

likely benign LLM, confidence 0.95 Persian prose containing legitimate zero-width non-joiners.

Reasoning

Persian text with ZWNJ (half-space) characters, which are normal orthography in Persian; test fixture for bidi/unicode handling.

info ~~warn~~ → info by review unicode-zero-width tests/misc/bidi.txt:14:127

U+200C ZERO WIDTH NON-JOINER in source (raw pass, confidence 0.75)

�⟨U+200C⟩گرا و یک زبان برنامه⟨U+200C⟩نویسی تفسیری سمت سرور قدرتمند است که توسط گیدو ون روسوم در سال ۱۹۹۰ ساخته شد. این زبان در ویژگی⟨U+200C⟩ها شبیه پرل، روبی، اسکیم، اسمال⟨U+200C⟩تاک و تی⟨U+200C⟩سی⟨U+200C⟩ال است و ا… (340 bytes total)

likely benign LLM, confidence 0.95 Persian prose with a ZWNJ in a test fixture.

Reasoning

Same Persian text fixture; ZWNJ is native orthography, not obfuscation.

info ~~warn~~ → info by review unicode-zero-width tests/misc/bidi.txt:14:300

U+200C ZERO WIDTH NON-JOINER in source (raw pass, confidence 0.75)
```
ه شد. این زبان در ویژگی⟨U+200C⟩ها شبیه پرل، روبی، اسکیم، اسمال⟨U+200C⟩تاک و تی⟨U+200C⟩سی⟨U+200C⟩ال است و از مدیریت خودکار حافظه استفاده می⟨U+200C⟩کند
```
likely benign LLM, confidence 0.95 Persian sentence with ZWNJ characters.
Reasoning
Standard Persian word spacing with ZWNJ in a multilingual test file.
info ~~warn~~ → info by review unicode-zero-width tests/misc/bidi.txt:14:360

U+200C ZERO WIDTH NON-JOINER in source (raw pass, confidence 0.75)
```
�ل، روبی، اسکیم، اسمال⟨U+200C⟩تاک و تی⟨U+200C⟩سی⟨U+200C⟩ال است و از مدیریت خودکار حافظه استفاده می⟨U+200C⟩کند
```
likely benign LLM, confidence 0.95 Persian sentence fragment with ZWNJ.
Reasoning
Persian text, ZWNJ is correct orthography; file is a unicode test corpus.
info ~~warn~~ → info by review unicode-zero-width tests/misc/bidi.txt:14:377

U+200C ZERO WIDTH NON-JOINER in source (raw pass, confidence 0.75)
```
اسکیم، اسمال⟨U+200C⟩تاک و تی⟨U+200C⟩سی⟨U+200C⟩ال است و از مدیریت خودکار حافظه استفاده می⟨U+200C⟩کند
```
likely benign LLM, confidence 0.95 Persian text with a ZWNJ.
Reasoning
Persian prose; ZWNJ usage is legitimate and the file is a test corpus.
info ~~warn~~ → info by review unicode-zero-width tests/misc/bidi.txt:14:384

U+200C ZERO WIDTH NON-JOINER in source (raw pass, confidence 0.75)
```
�م، اسمال⟨U+200C⟩تاک و تی⟨U+200C⟩سی⟨U+200C⟩ال است و از مدیریت خودکار حافظه استفاده می⟨U+200C⟩کند
```
likely benign LLM, confidence 0.95 Persian text with a ZWNJ.
Reasoning
Persian prose; ZWNJ is normal here.
info ~~warn~~ → info by review unicode-zero-width tests/misc/bidi.txt:14:463

U+200C ZERO WIDTH NON-JOINER in source (raw pass, confidence 0.75)
```
�دکار حافظه استفاده می⟨U+200C⟩کند
```
likely benign LLM, confidence 0.95 Persian phrase with a ZWNJ.
Reasoning
Persian phrase with ZWNJ in a multilingual test fixture.
info ~~warn~~ → info by review unicode-homoglyph tests/misc/bidi.txt:64:446

identifier `В` contains homoglyph candidates: В (0412)→B (raw pass, confidence 0.70)
```
в морали Спрингфилда. В эпизоде «Alone Again, Natura-Diddily»  он овдовел, его жена Мод погибла в результате несчастного случая. 
```
likely benign LLM, confidence 0.93 Cyrillic capital letter in Russian Simpsons prose.
Reasoning
Russian prose in a text fixture; Cyrillic В is a real Russian letter, not an identifier in code. Homoglyph flag is a false positive from a non-code file.

info ~~warn~~ → info by review unicode-homoglyph tests/misc/bidi.txt:66:180

identifier `с` contains homoglyph candidates: с (0441)→c (raw pass, confidence 0.70)

ьи Симпсонов. Начиная с первых серий, он регулярно появляется в «Симпсонах». Считается, что Нед Фландерс был назван в честь улицы *Northeast Flanders St.* в [Портленде](http://www.portland.gov), Орег… (340 bytes total)

likely benign LLM, confidence 0.93 Cyrillic word 'с' in Russian text.

Reasoning

Russian prose with Cyrillic с, a normal word ('с' meaning 'from'). Not code; false positive.

info ~~warn~~ → info by review narrow-file-charset tests/misc/bracket_re.html:1:1

file uses only 6 distinct printable characters ("/<>[px") — JSF*ck-style or character-constrained obfuscation (raw pass, confidence 0.90)
```
[x
xxx xxx xxx xxx xxx xxx xxx xxx
xxx xxx xxx xxx xxx xxx xxx xxx
```
likely benign LLM, confidence 0.90 A small HTML test fixture containing bracket and x characters, likely for regex testing.
Reasoning
The file lives under tests/misc and its name suggests a regex test fixture for bracket handling. The snippet is a short HTML paragraph with a handful of repeated 'xxx' tokens and a bracket. The narrow charset comes from the test data itself, not from any executable payload, so it is not JSF*ck-style obfuscation.
info ~~warn~~ → info by review narrow-file-charset tests/misc/bracket_re.txt:1:1

file uses only 2 distinct printable characters ("[x") — JSF*ck-style or character-constrained obfuscation (raw pass, confidence 0.90)
```
[x
xxx xxx xxx xxx xxx xxx xxx xxx
```
likely benign LLM, confidence 0.90 A plain text regex test fixture made of brackets and x characters.
Reasoning
This is a plain text test fixture in a tests directory whose name points to bracket regex testing. It contains only '[', 'x' and whitespace, which is an expected input for such a test. There is no code execution or decoding path, so the narrow charset is incidental.

info long-line tests/misc/russian.html:5:1

line length 768 characters (raw pass, confidence 0.50)

<p>Нед Фландерс родился в Нью-Йорке, его родители были битниками. Его отец в точности похож на взрослого Неда, только он носил козлиную бородку. Их отказ от воспитания Неда и то,

info ~~warn~~ → info by review whitespace-anomaly tests/test_syntax/extensions/test_tables.py:32:1

invisible whitespace U+00A0 in indentation (raw pass, confidence 0.80)
```
        text = """
⟨U+00A0⟩  | Second Header
------------- | -------------
⟨U+00A0⟩  | Content Cell
```
likely benign LLM, confidence 0.90 Non-breaking space inside a markdown table test string.
Reasoning
Inside a Python triple-quoted markdown test string for table syntax; the NBSP in indentation is part of the test input for Markdown table parsing, not runtime obfuscation.
info ~~warn~~ → info by review whitespace-anomaly tests/test_syntax/extensions/test_tables.py:34:1

invisible whitespace U+00A0 in indentation (raw pass, confidence 0.80)
```
------------- | -------------
⟨U+00A0⟩  | Content Cell
Content Cell  | ⟨U+00A0⟩
"""
```
likely benign LLM, confidence 0.90 Non-breaking space within a markdown table test literal.
Reasoning
Same test string for markdown tables; NBSP is intentional test content within a docstring-like literal and not executed.
info ~~warn~~ → info by review dynamic-execution tools/superfences_formaters.py:113:13

`exec` called on a non-literal expression (ast pass, confidence 0.70)
```
        try:
            exec(source, self.globals, self.locals)
        except KeyboardInterrupt:
            sys.stdout.close()
```
likely benign LLM, confidence 0.85 exec of code block source inside a markdown fence formatter tool.
Reasoning
This is the superfences formatter from pymdown-extensions, which executes user-supplied code blocks in a documentation build context by design (the source is the markdown author's code). Dynamic exec is expected here, though it is a genuine execution sink; no sign of obfuscation or hidden payload.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.1.0
git clone https://github.com/Python-Markdown/markdown markdown && cd markdown
git checkout 3.11.2
disclude scan --severity info --diff 3.11.1 .