Default preset (html=True) diverges from upstream JS markdown-it (html:false): untrusted raw HTML injected by default -> XSS

[plotarmordev]

Security-relevant default drift in markdown-it-py (Python port)

markdown-it-py 4.2.0 MarkdownIt().options.html defaults to True, whereas the upstream JS markdown-it 15.0.0 'default' preset defaults to html:false (escapes raw HTML).

Repro (Python):

from markdown_it import MarkdownIt
print(MarkdownIt().render('<script>alert(1)</script>'))
# -> '<script>alert(1)</script>'   (raw script in output => executes)

JS reference (same 'default' preset): md.render('<script>..') -> <script>.. (escaped, inert).

Consequence: an app that renders UNTRUSTED markdown through markdown-it-py with default options (as one would with the JS library's secure default) gets stored/reflected HTML/script injection that the JS library prevents by default. All extant markdown-it-py advisories (GHSA-jrwr-5x3p-hvc3, GHSA-vrjv-mxr7-vjf8, PYSEC-2023-23/24) are DoS; none cover this.

Ask: make the 'default' preset mirror upstream (html:false), or at minimum document the security implication and recommend html=False / sanitizer for untrusted input.

[rawsun007]

The behaviour you describe reproduces, but I think the diagnosis in the title is not quite right, and it changes what the fix would be.

The default preset does not diverge from upstream. It already matches JS:

MarkdownIt()               html = True
MarkdownIt("default")      html = False     <- matches JS 'default' (html: false)
MarkdownIt("js-default")   html = False
MarkdownIt("commonmark")   html = True
MarkdownIt("zero")         html = False

MarkdownIt("default").render("<script>alert(1)</script>")
'<p>&lt;script&gt;alert(1)&lt;/script&gt;</p>\n'

What differs is which preset the no-argument constructor picks:

# markdown_it/main.py:36
def __init__(self, config: str | PresetType = "commonmark", ...)

Python MarkdownIt() is equivalent to JS markdownit('commonmark'), not JS markdownit(). And html: True is arguably correct for the commonmark preset specifically, since raw HTML passthrough is mandated by the CommonMark spec, so that preset is not itself wrong.

So the drift is one line in the constructor signature, not the preset table. That matters for the two options you offer:

• Changing default's html would be a no-op, since it is already False.
• Changing the constructor default from "commonmark" to "default" would fix parity, but it is a breaking change for every caller relying on MarkdownIt() accepting HTML, and it silently changes enabled rules too, not just html.
• The documentation route stays fully available and is unaffected by any of the above: MarkdownIt() is CommonMark, which passes raw HTML through by design, and untrusted input wants MarkdownIt("default"), "zero", or a sanitizer.

I have not sent a patch since which of those you want is a maintainer call, and the constructor default is not something to flip on a drive-by.

Verified on 4.2.0.dev at main, Python 3.12.

Disclosure: investigated with Claude Code. I ran every line above myself; the preset values are read from markdown_it/presets/.