Allowed Characters in Descriptions and Workarounds

[eslerm]

In CVEProject/cvelistV5#21 it was asked that newlines be removed from JSON5 descriptions in the cvelistV5 repo.

Looking at the schema, any string between 1 and 4096 characters is valid.

Are CNAs allowed to embed HTML formatting into CVE descriptions?

[chandanbn]

The descriptions are supposed to be plain text - newlines, spaces and tabs allowed for readability.

For anything more, one can utilize supportingMedia construct to include alternative representation of the plain text like markdown, HTML, images etc.,

CVE descriptions are technical writings - it would be hard and restrictive to define an allowed list of characters.