DEBIAN-CVE-2026-44708

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.2.1, the mistune math plugin renders inline math $...$ and block math $$...$$ by concatenating the raw user-supplied content directly into the HTML output without any HTML escaping. This occurs even when the parser is...

ai-shell (>=0.1.0, <=1.0.4), almax-common (>=0.9.5, <=1.0.2) +137 more potentially affected by CVE-2026-44708 via mistune (>=3.0.0rc5, <=3.2.0)

mistune PYPI version =3.0.0rc5, =0.1.0, =0.9.5, =3.0.0rc3, =3.2.1b1, =1.0.1, =1.0.1, =0.1.0, =0.0.1, =0.1.0, =0.0.2, =1.0.0.1, =0.0.1, =0.1.10, =0.26.0, =0.27.0 and more Source cves: CVE-2026-44708 Source advisory: OSV:PYSEC-2026-2206...

cfnow (>=0.0.1, <=0.0.6), coreplus (0.1.0) +20 more potentially affected by CVE-2026-44708 via mistune (2.0.4)

mistune PYPI version 2.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on mistune and may be impacted: - cfnow =0.0.1, =0.1.1rc3, =0.1.0, =1.4.0, =4.0.2, =2.2.1, =0.1.0, =0.1.0, =0.0.3, =1.0.4, =1.0.7 and more Source cves: CVE-2026-44708 Source...

mvrk (>=1.2.0, <=1.2.1), repo-cli (>=0.0.1.8, <=0.0.1.14) potentially affected by CVE-2026-44708 via mistune (2.0.0a4)

mistune PYPI version 2.0.0a4 is affected by a known vulnerability. The following packages have a transitive dependency on mistune and may be impacted: - mvrk =1.2.0, =0.0.1.8, =0.0.1.14 Source cves: CVE-2026-44708 Source advisory: OSV:PYSEC-2026-2206...

cateye (>=0.3.4, <=0.3.8), docwriter (>=0.1.0, <=1.0.2) +6 more potentially affected by CVE-2026-44708 via mistune (0.8.3)

mistune PYPI version 0.8.3 is affected by a known vulnerability. The following packages have a transitive dependency on mistune and may be impacted: - cateye =0.3.4, =0.1.0, =1.1.2, =0.1.0.dev0, =0.0.10, =0.0.1, =0.6.0, =0.15.0 Source cves: CVE-2026-44708 Source advisory: OSV:PYSEC-2026-2206...

AZL-88397 CVE-2026-44708 affecting package python-mistune for versions less than 3.2.1-1

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.2.1, the mistune math plugin renders inline math $...$ and block math $$...$$ by concatenating the raw user-supplied content directly into the HTML output without any HTML escaping. This occurs even when the parser is...

CVE-2026-44708

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.2.1, the mistune math plugin renders inline math $...$ and block math $$...$$ by concatenating the raw user-supplied content directly into the HTML output without any HTML escaping. This occurs even when the parser is...

CVE-2026-44899

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.2.1, the Image directive plugin validates the :width: and :height: options with a regex compiled as numre = re.compiler"^\d+?:.\d?". When the validated value is not a plain integer, renderblockimage inserts it directly int...

CVE-2026-44896

Mistune is a Python Markdown parser with renderers and plugins. In 3.2.0 and earlier, in src/mistune/directives/image.py, the renderfigure function concatenates figclass and figwidth options directly into HTML attributes without escaping. This allows attribute injection and XSS even when...

UBUNTU-CVE-2026-44897

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.2.1, HTMLRenderer.heading builds the opening tag by string-concatenating the id attribute value directly into the HTML — with no call to escape, safeentity, or any other sanitisation function. A double-quote character " in...

CVE-2026-44897

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.2.1, HTMLRenderer.heading builds the opening tag by string-concatenating the id attribute value directly into the HTML — with no call to escape, safeentity, or any other sanitisation function. A double-quote character " in...

CVE-2026-44708

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.2.1, the mistune math plugin renders inline math $...$ and block math $$...$$ by concatenating the raw user-supplied content directly into the HTML output without any HTML escaping. This occurs even when the parser is...

UBUNTU-CVE-2026-44708

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.2.1, the mistune math plugin renders inline math $...$ and block math $$...$$ by concatenating the raw user-supplied content directly into the HTML output without any HTML escaping. This occurs even when the parser is...

UBUNTU-CVE-2026-44898

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.2.1, rendertocul builds a table-of-contents tree from a list of level, id, text tuples. Both the id value used as href="" and the text value used as the visible link label are inserted into tags via a plain Python format...

UBUNTU-CVE-2026-44899

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.2.1, the Image directive plugin validates the :width: and :height: options with a regex compiled as numre = re.compiler"^\d+?:.\d?". When the validated value is not a plain integer, renderblockimage inserts it directly int...

CVE-2026-44898

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.2.1, rendertocul builds a table-of-contents tree from a list of level, id, text tuples. Both the id value used as href="" and the text value used as the visible link label are inserted into tags via a plain Python format...

UBUNTU-CVE-2026-44896

Mistune is a Python Markdown parser with renderers and plugins. In 3.2.0 and earlier, in src/mistune/directives/image.py, the renderfigure function concatenates figclass and figwidth options directly into HTML attributes without escaping. This allows attribute injection and XSS even when...

CVE-2026-44898

Mistune (Python Markdown parser) contains a TOC rendering flaw in render_toc_ul() prior to version 3.2.1: it inserts the heading ID (k) and text directly into an and the visible label without escaping, enabling an attacker to craft a heading whose text breaks out of the href context and injects ...

fittrackee (>=1.2.0, <=1.3.0b3), mein-et-projekt (0.1.0) +2 more potentially affected by CVE-2026-44898 via mistune (3.2.0)

mistune PYPI version 3.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on mistune and may be impacted: - fittrackee =1.2.0, =2.19.0, =2.20.4 - uniovi-simur-wearablepermed-pipeline-step-counting 1.2.3 Source cves: CVE-2026-44898 Source advisory:...

CVE-2026-44898 Mistune TOC Anchor Injection XSS

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.2.1, rendertocul builds a table-of-contents tree from a list of level, id, text tuples. Both the id value used as href="" and the text value used as the visible link label are inserted into tags via a plain Python format...