1030 matches found
CVE-2026-59923: Improper Neutralization of Input During Web Page Generation
Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, HTMLRenderer.safeurl does not block percent-encoded javascript URIs, allowing attacker-supplied Markdown links or images to bypass URL protections and execute script in rendered HTML. This issue is fixed in version...
CVE-2026-59922: Inefficient Algorithmic Complexity
Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, a run of closed tilde, equals-sign, or caret marker pairs around a character causes quadratic work in src/mistune/plugins/formatting.py when the strikethrough, mark, or insert plugin scans for matching markers from ea...
CVE-2026-59924: Improper Limitation of a Pathname to a Restricted Directory
Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, Include.parse joins and normalizes user-supplied include paths without verifying that the result remains within the intended markdown directory, allowing crafted include paths to access files outside that directory wh...
CVE-2026-59926: Improper Neutralization of Input During Web Page Generation
Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.2.1, renderadmonition in src/mistune/directives/admonition.py concatenates the Admonition directive :class: option into the HTML class attribute without escaping, allowing attribute injection and cross-site scripting even...
CVE-2026-59925: Inefficient Algorithmic Complexity
Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, long sequences of well-formed double-asterisk or triple-asterisk emphasis pairs around a character cause quadratic work in src/mistune/inlineparser.py because the parser scans forward for matching close markers from...
CVE-2026-59930: Insufficient Verification of Data Authenticity
Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, the toc plugin and TableOfContents directive generate heading IDs as predictable tocN values without slugifying the heading text, allowing attacker-controlled id="tocN" content to collide with generated anchors and...
PT-2026-56511
Name of the Vulnerable Software and Affected Versions Mistune versions prior to 3.2.1 Description The render admonition function in src/mistune/directives/admonition.py concatenates the :class: option of the Admonition directive into the HTML class attribute without proper escaping. This allows f...
PT-2026-56510
Name of the Vulnerable Software and Affected Versions Mistune versions prior to 3.3.0 Description A denial of service issue exists in the default parsing process. Long sequences of well-formed double-asterisk or triple-asterisk emphasis pairs around a character cause quadratic work in...
CVE-2026-59927: Uncontrolled Recursion
Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, the Include directive in src/mistune/directives/include.py detects only direct self-includes and not indirect cycles, allowing two markdown files that include each other to trigger unbounded recursion, raise...
PT-2026-56513
Name of the Vulnerable Software and Affected Versions Mistune versions prior to 3.3.0 Description The toc plugin and TableOfContents directive generate heading IDs using predictable toc N values instead of slugifying the heading text. This allows attacker-controlled content with id="toc N" to...
PT-2026-56508
Name of the Vulnerable Software and Affected Versions Mistune versions prior to 3.3.0 Description A flaw in the Python Markdown parser occurs when the strikethrough, mark, or insert plugins scan for matching markers from each possible start position. Specifically, a sequence of closed tilde,...
PT-2026-56512
Name of the Vulnerable Software and Affected Versions Mistune versions prior to 3.3.0 Description The safe url filter in src/mistune/renderers/html.py fails to block several legacy or chained URI schemes. While it restricts javascript:, vbscript:, file:, and data:, it allows schemes such as feed:...
PT-2026-56517
Name of the Vulnerable Software and Affected Versions Mistune versions prior to 3.3.0 Description Mistune is a Python Markdown parser with renderers and plugins. The Include.parse function joins and normalizes user-supplied include paths without verifying that the result remains within the intend...
PT-2026-56519
Name of the Vulnerable Software and Affected Versions Mistune versions prior to 3.3.0 Description A Python Markdown parser with renderers and plugins contains an issue where a Markdown document with numerous repeated or distinct reference-link definitions triggers quadratic work within...
PT-2026-56509
Name of the Vulnerable Software and Affected Versions Mistune versions prior to 3.3.0 Description The HTMLRenderer.safe url function fails to block percent-encoded javascript URIs. This allows an attacker to use specially crafted Markdown links or images to bypass URL protections and execute...
python311-mistune-3.3.2-1.1 on GA media (moderate)
python311-mistune-3.3.2-1.1 on GA media Announcement ID: openSUSE-SU-2026:11180-1 Rating: moderate Cross-References: CVE-2026-49851 CVSS scores: CVE-2026-49851 SUSE : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Tumbleweed An update that solves one vulnerability ca...
openSUSE 16 Security Update : python-mistune (openSUSE-SU-2026:21191-1)
The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:21191-1 advisory. This update for python-mistune fixes the following issue - CVE-2026-49851: potential DoS via quadratic-time parsing in parselinktext bsc1269091. Tenable...
PT-2026-55560
These are all security issues fixed in the python311-mistune-3.3.2-1.1 package on the GA media of openSUSE Tumbleweed...
