Photon OS 5.0: Python3 PHSA-2026-5.0-92-0947

An update of the python3 package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-92-0947. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

CVE-2026-44897

Mistune prior to 3.2.1 constructs the HTML heading tag by appending the id attribute value directly, without escaping. If the heading_id callback returns raw text containing quotes or markup, an attacker can inject arbitrary attributes (e.g., onmouseover, src, href) into the element, enabling XS...

CVE-2026-44897 Mistune Heading ID Attribute Injection XSS

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.2.1, HTMLRenderer.heading builds the opening tag by string-concatenating the id attribute value directly into the HTML — with no call to escape, safeentity, or any other sanitisation function. A double-quote character " in...