EUVD-2026-108422

Mistune before 3.3.0 contains a path traversal vulnerability in the RST include directive that allows attackers to read arbitrary files by supplying relative or absolute paths. Attackers can submit markdown containing include directives referencing ../ sequences or absolute paths to embed sensiti...

CVE-2026-115353 Mistune before 3.3.0 Path Traversal via include Directive

Mistune before 3.3.0 contains a path traversal vulnerability in the RST include directive that allows attackers to read arbitrary files by supplying relative or absolute paths. Attackers can submit markdown containing include directives referencing ../ sequences or absolute paths to embed sensiti...

CVE-2026-115352

Mistune versions before 3.3.0 are vulnerable to an algorithmic complexity issue in the inline link parser . An unauthenticated attacker can submit small markdown payloads containing long sequences of unmatched '[' characters to trigger O(N^2) parse_link_text and parse_link_label probing. This all...

CVE-2026-115352 Mistune before 3.3.0 Quadratic-Time DoS via Unmatched Brackets in Inline Parser

Mistune before 3.3.0 contains an algorithmic complexity vulnerability in the inline link parser that allows unauthenticated attackers to exhaust CPU by submitting long runs of unmatched '' characters. Attackers can send small markdown payloads that trigger ON^2 parselinktext and parselinklabel...

EUVD-2026-108421

Mistune before 3.3.0 contains an algorithmic complexity vulnerability in the inline link parser that allows unauthenticated attackers to exhaust CPU by submitting long runs of unmatched '' characters. Attackers can send small markdown payloads that trigger ON^2 parselinktext and parselinklabel...

CVE-2026-115352 Mistune before 3.3.0 Quadratic-Time DoS via Unmatched Brackets in Inline Parser

Mistune before 3.3.0 contains an algorithmic complexity vulnerability in the inline link parser that allows unauthenticated attackers to exhaust CPU by submitting long runs of unmatched '' characters. Attackers can send small markdown payloads that trigger ON^2 parselinktext and parselinklabel...

CVE-2026-115352

Mistune before 3.3.0 contains an algorithmic complexity vulnerability in the inline link parser that allows unauthenticated attackers to exhaust CPU by submitting long runs of unmatched '' characters. Attackers can send small markdown payloads that trigger ON^2 parselinktext and parselinklabel...

CVE-2026-115351 Mistune 3.2.1 before 3.3.0 CSS Injection via Figure Directive figwidth Option

Mistune from 3.2.1 before 3.3.0 contains a CSS injection vulnerability that allows attackers controlling markdown input to inject arbitrary style declarations via the unvalidated figwidth option of the figure directive. Attackers can append declarations like background:url to the rendered figure...

CVE-2026-115351

The Mistune markdown parser (versions 3.2.1 before 3.3.0 ) contains a CSS injection vulnerability (CWE-94). The issue stems from the unvalidated figwidth option within the figure directive , allowing attackers who control markdown input to inject arbitrary style declarations. Specifically, an att...

EUVD-2026-108420

Mistune from 3.2.1 before 3.3.0 contains a CSS injection vulnerability that allows attackers controlling markdown input to inject arbitrary style declarations via the unvalidated figwidth option of the figure directive. Attackers can append declarations like background:url to the rendered figure...

CVE-2026-115351 Mistune 3.2.1 before 3.3.0 CSS Injection via Figure Directive figwidth Option

Mistune from 3.2.1 before 3.3.0 contains a CSS injection vulnerability that allows attackers controlling markdown input to inject arbitrary style declarations via the unvalidated figwidth option of the figure directive. Attackers can append declarations like background:url to the rendered figure...

EUVD-2026-108418

Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity denial of service vulnerability in the parselinktext function in src/mistune/helpers.py. Attackers can submit markdown with deeply nested square brackets triggering quadratic parsing time, exhausting server CPU with small crafted...

EUVD-2026-108419

Mistune before 3.3.0 contains a cross-site scripting vulnerability in the Include directive that emits included .html, .xhtml, or .htm file content as raw blockhtml tokens. Attackers who can plant an HTML file readable by the renderer can reference it via an include directive, combined with path...

CVE-2026-115349 Mistune 3.0.0 before 3.3.0 Denial of Service via Nested Bracket Parsing

Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity denial of service vulnerability in the parselinktext function in src/mistune/helpers.py. Attackers can submit markdown with deeply nested square brackets triggering quadratic parsing time, exhausting server CPU with small crafted...

CVE-2026-115350 Mistune before 3.3.0 Stored XSS via Include Directive HTML Files

Mistune before 3.3.0 contains a cross-site scripting vulnerability in the Include directive that emits included .html, .xhtml, or .htm file content as raw blockhtml tokens. Attackers who can plant an HTML file readable by the renderer can reference it via an include directive, combined with path...

CVE-2026-115350

Versions of Mistune prior to 3.3.0 are vulnerable to a stored cross-site scripting (XSS) vulnerability within the Include directive . The root cause is that the renderer emits content from included .html, .xhtml, or .htm files as raw block_html tokens. An attacker who can plant a readable HTML fi...

CVE-2026-115349 Mistune 3.0.0 before 3.3.0 Denial of Service via Nested Bracket Parsing

Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity denial of service vulnerability in the parselinktext function in src/mistune/helpers.py. Attackers can submit markdown with deeply nested square brackets triggering quadratic parsing time, exhausting server CPU with small crafted...

CVE-2026-115349

The Mistune markdown library, versions 3.0.0 through 3.2.x , is vulnerable to an algorithmic complexity denial of service (DoS) in the parse_link_text function located in src/mistune/helpers.py. An attacker can submit a small, specially crafted markdown request containing deeply nested square bra...

CVE-2026-115350 Mistune before 3.3.0 Stored XSS via Include Directive HTML Files

Mistune before 3.3.0 contains a cross-site scripting vulnerability in the Include directive that emits included .html, .xhtml, or .htm file content as raw blockhtml tokens. Attackers who can plant an HTML file readable by the renderer can reference it via an include directive, combined with path...

CVE-2026-115348

The Mistune Markdown parser versions 3.0.0 through 3.2.x (before 3.3.0) is vulnerable to an algorithmic complexity flaw in the parse_link_text function. Unauthenticated attackers can cause a Denial of Service (DoS) by submitting Markdown containing numerous unbalanced [ or ![ characters. This tri...