HTML special characters are not escaped in some PEP headers

The Docutils project recieved a security bug report regarding the Docutils PEP parser.
While the affected code is not used by "python/peps/" anymore, the problem persists in the function that replaced it in peps/sphinx-extensions.

Please advise me how to report the problem securely.

Please see the security policy to report issues about this repo:

https://github.com/python/peps/security/policy

If the security issue is just that a PEP author could inject code into a header that runs JS in a viewer's browser, I'm not sure that's a big issue: the only people with commit access to the PEPs also have the commit access to the PEP rendering pipeline, so they could already inject arbitrary JS.

The exploit requires "strange" text in the PEP source, so this is no open gap, indeed.
The report to Docutils is now public: https://sourceforge.net/p/docutils/bugs/519/

The use of a "raw" HTML node for email masking is present in peps/pep_sphinx_extensions/pep_processor/transforms/pep_zero.py.
Cf. commit https://sourceforge.net/p/docutils/code/10394/ to see how Docutils fixed this.

Thanks for the followup. The fix is pretty small, but I think we're fine as we won't merge strange text like the below, so let's close.

Title: </title><script>alert('XSS')</script>

Author: `"><img src=x onerror=alert(1)> <evil@example.com>`_

Come to think of it though, is this a problem for the RTD previews we automatically generate?

Hmm, I guess so! Okay, let's re-open and fix :)

Well, the build falls over for either of:

Title: </title><script>alert('XSS')</script>
Author: `"><img src=x onerror=alert(1)> <evil@example.com>`_

Like:

sphinx.errors.SphinxParallelError: docutils.utils.SystemMessage: /Users/hugo/github/peps/peps/pep-0000.rst:759: (ERROR/3) invalid PEP number script>alert('XSS')</script> <9999

sphinx.errors.SphinxParallelError: docutils.utils.SystemMessage: /Users/hugo/github/peps/peps/numerical.rst:3704: (WARNING/2) Inline interpreted text or phrase reference start-string without end-string.

But these do trigger:

Sponsor: `"><img src=x onerror=alert(1)> <mailto:evil@example.com>`__
BDFL-Delegate: `"><svg onload=alert(2)> <mailto:evil2@example.com>`__

However, someone could always just do this:

.. raw:: html

   <script>alert('XSS via raw directive')</script>
   <img src=x onerror=alert('also this')>

Or indeed put any JS in the build and include the normal way, so it doesn't really matter much if we fix this.

Anyway, I've opened #5113 in case we do want to cover header bits.

Yeah, a malicious PR could also just edit the processor and create a preview with injections.

Your PR seems like a positive though, so let's land it.

However, someone could always just do this:

.. raw:: html
<script>alert('XSS via raw directive')</script>
<img src=x onerror=alert('also this')>
Or indeed put any JS in the build and include the normal way, so it doesn't really matter much if we fix this.

Then maybe the approach we should take is to have previews only automatically activated for known users, and for everyone else, the PR waits without a preview until someone has approved it for rendering. I believe that can be done?

Navigation Menu

Repository navigation

HTML special characters are not escaped in some PEP headers #5096

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

HTML special characters are not escaped in some PEP headers #5096

Description

Activity

hugovk commented on Aug 15, 2026

JelleZijlstra commented on Aug 15, 2026

gmilde commented on Aug 31, 2026

hugovk commented on Sep 1, 2026

JelleZijlstra commented on Sep 1, 2026

hugovk commented on Sep 1, 2026

hugovk commented on Sep 1, 2026

JelleZijlstra commented on Sep 1, 2026

Rosuav commented on Sep 1, 2026

Metadata

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Issue actions