Photon OS 5.0: Python3 PHSA-2026-5.0-92-0947

An update of the python3 package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-92-0947. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

abracadabra (>=0.0.0, <=0.0.7), acclimatise (>=0.0.18, <=1.2.0) +420 more potentially affected by CVE-2026-59922 via mistune (0.8.4)

mistune PYPI version 0.8.4 is affected by a known vulnerability. The following packages have a transitive dependency on mistune and may be impacted: - abracadabra =0.0.0, =0.0.18, =2.0.0.post1, =0.3.0, =1.0.0, =1.3.4, =1.0.47, =1.0.66, =0.1.0, =0.1.0, =0.1.16, =0.18.3, =1.0.0, =2.2.0 and more...

animalia (>=0.0.27, <=0.0.28), appyratus (>=3.0.3, <=3.0.4) +32 more potentially affected by CVE-2026-59922 via mistune (2.0.0rc1)

mistune PYPI version 2.0.0rc1 is affected by a known vulnerability. The following packages have a transitive dependency on mistune and may be impacted: - animalia =0.0.27, =3.0.3, =0.1.0, =0.11.0, =0.20.7, =0.0.5, =0.0.13, =1.0.18, =0.0.1, =0.1.3 - datapackage-pipelines-spss 0.0.2a0 - embryo 3.0....

engrave (>=2.0.0, <=2.0.4), inka (>=2.1.0, <=2.2.0) +1 more potentially affected by CVE-2026-59922 via mistune (2.0.2)

mistune PYPI version 2.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on mistune and may be impacted: - engrave =2.0.0, =2.1.0, =0.0.0.dev0, =1.13.0a1.dev3 Source cves: CVE-2026-59922 Source advisory: OSV:GHSA-C8J7-8CV4-2XMQ...

kart (>=0.8.0, <=0.8.1) potentially affected by CVE-2026-59922 via mistune (2.0.0a6)

mistune PYPI version 2.0.0a6 is affected by a known vulnerability. The following packages have a transitive dependency on mistune and may be impacted: - kart =0.8.0, =0.8.1 Source cves: CVE-2026-59922 Source advisory: OSV:GHSA-C8J7-8CV4-2XMQ...

cfnow (>=0.0.1, <=0.0.6), coreplus (0.1.0) +20 more potentially affected by CVE-2026-59922 via mistune (2.0.4)

mistune PYPI version 2.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on mistune and may be impacted: - cfnow =0.0.1, =0.1.1rc3, =0.1.0, =1.4.0, =4.0.2, =2.2.1, =0.1.0, =0.1.0, =0.0.3, =1.0.4, =1.0.7 and more Source cves: CVE-2026-59922 Source...

arvados-cwl-runner (>=2.6.0rc3, <=2.7.4), db-classifier (0.0.2) +18 more potentially affected by CVE-2026-59922 via mistune (2.0.5)

mistune PYPI version 2.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on mistune and may be impacted: - arvados-cwl-runner =2.6.0rc3, =2.0.5, =4.1.0, =0.8.4, =2.1.1, =1.0.0, =2.2.0, =0.0.1, =2.4.1rc3, =8.3.20221209165047, =8.5.20240102191335 - sitefa...

Security update for python-mistune (moderate)

openSUSE security update: security update for python-mistune ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21339-1 Rating: moderate References: bsc1271082 bsc1271117 bsc1271119 bsc1271121 bsc1271125 bsc1271127 bsc1271128 bsc1271131 bsc1271132...

biobb-io (>=0.0.1, <=0.0.8), biobb-model (>=0.0.1, <=0.0.10) +3 more potentially affected by CVE-2026-59922 via mistune (0.7.4)

mistune PYPI version 0.7.4 is affected by a known vulnerability. The following packages have a transitive dependency on mistune and may be impacted: - biobb-io =0.0.1, =0.0.1, =0.2.1, =2.2.20170208112505, =2.7.20181012180226 Source cves: CVE-2026-59922 Source advisory: OSV:PYSEC-2026-2210...

cateye (>=0.3.4, <=0.3.8), docwriter (>=0.1.0, <=1.0.2) +6 more potentially affected by CVE-2026-59922 via mistune (0.8.3)

mistune PYPI version 0.8.3 is affected by a known vulnerability. The following packages have a transitive dependency on mistune and may be impacted: - cateye =0.3.4, =0.1.0, =1.1.2, =0.1.0.dev0, =0.0.10, =0.0.1, =0.6.0, =0.15.0 Source cves: CVE-2026-59922 Source advisory: OSV:PYSEC-2026-2210...

abracadabra (>=0.0.0, <=0.0.7), acclimatise (>=0.0.18, <=1.2.0) +420 more potentially affected by CVE-2026-59922 via mistune (0.8.4)

mistune PYPI version 0.8.4 is affected by a known vulnerability. The following packages have a transitive dependency on mistune and may be impacted: - abracadabra =0.0.0, =0.0.18, =2.0.0.post1, =0.3.0, =1.0.0, =1.3.4, =1.0.47, =1.0.66, =0.1.0, =0.1.0, =0.1.16, =0.18.3, =1.0.0, =2.2.0 and more...

animalia (>=0.0.27, <=0.0.28), appyratus (>=3.0.3, <=3.0.4) +32 more potentially affected by CVE-2026-59922 via mistune (2.0.0rc1)

mistune PYPI version 2.0.0rc1 is affected by a known vulnerability. The following packages have a transitive dependency on mistune and may be impacted: - animalia =0.0.27, =3.0.3, =0.1.0, =0.11.0, =0.20.7, =0.0.5, =0.0.13, =1.0.18, =0.0.1, =0.1.3 - datapackage-pipelines-spss 0.0.2a0 - embryo 3.0....

nlm-ingestor (>=0.1.1, <=0.1.5), nvidia-modulus-sym (>=1.0.0, <=1.7.0) +1 more potentially affected by CVE-2026-59922 via mistune (2.0.3)

mistune PYPI version 2.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on mistune and may be impacted: - nlm-ingestor =0.1.1, =1.0.0, =1.7.0 - stattic 1.0.0 Source cves: CVE-2026-59922 Source advisory: OSV:PYSEC-2026-2210...

ai-shell (>=0.1.0, <=1.0.4), airut (>=0.25.5, <=0.27.0) +141 more potentially affected by CVE-2026-59922 via mistune (>=3.0.0rc5, <=3.2.1)

mistune PYPI version =3.0.0rc5, =0.1.0, =0.25.5, =0.9.5, =3.0.0rc3, =3.2.1b1, =1.0.1, =1.0.1, =0.1.0, =0.0.1, =0.1.0, =0.0.2, =1.0.0.1, =0.0.1, =0.1.10, =0.1.20 and more Source cves: CVE-2026-59922 Source advisory: OSV:PYSEC-2026-2210...

cfnow (>=0.0.1, <=0.0.6), coreplus (0.1.0) +20 more potentially affected by CVE-2026-59922 via mistune (2.0.4)

mistune PYPI version 2.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on mistune and may be impacted: - cfnow =0.0.1, =0.1.1rc3, =0.1.0, =1.4.0, =4.0.2, =2.2.1, =0.1.0, =0.1.0, =0.0.3, =1.0.4, =1.0.7 and more Source cves: CVE-2026-59922 Source...

arvados-cwl-runner (>=2.6.0rc3, <=2.7.4), db-classifier (0.0.2) +18 more potentially affected by CVE-2026-59922 via mistune (2.0.5)

mistune PYPI version 2.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on mistune and may be impacted: - arvados-cwl-runner =2.6.0rc3, =2.0.5, =4.1.0, =0.8.4, =2.1.1, =1.0.0, =2.2.0, =0.0.1, =2.4.1rc3, =8.3.20221209165047, =8.5.20240102191335 - sitefa...

CVE-2026-59922

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, a run of closed tilde, equals-sign, or caret marker pairs around a character causes quadratic work in src/mistune/plugins/formatting.py when the strikethrough, mark, or insert plugin scans for matching markers from ea...

abracadabra (>=0.0.0, <=0.0.7), acclimatise (>=0.0.18, <=1.2.0) +666 more potentially affected by CVE-2026-59922 via mistune (>=0.7.3, <=3.2.1)

mistune PYPI version =0.7.3, =0.0.0, =0.0.18, =2.0.0.post1, =0.3.0, =1.0.0, =0.1.0, =1.3.4, =0.25.5, =1.0.47, =1.0.66, =0.9.5, =0.21.2, =0.0.27, =0.0.28 and more Source cves: CVE-2026-59922 Source advisory: MEND:CVE-2026-59922...

CVE-2026-59922

Mistune (Python Markdown parser) contains a quadratic-time DoS in formatting.py for long runs of marker pairs (x , ==x==, ^^x^^) in the strikethrough/mark/insert plugins. The issue arises from scanning for matching markers from every possible start position, causing CPU exhaustion. It is fixed in...