CVE-2026-115351

A flaw was found in mistune. A remote attacker with control over markdown content can cause information disclosure by performing Cascading Style Sheets CSS injection through the unvalidated figwidth option in the figure directive. By inserting arbitrary style rules into rendered web pages, the...

CVE-2026-115351

Mistune from 3.2.1 before 3.3.0 contains a CSS injection vulnerability that allows attackers controlling markdown input to inject arbitrary style declarations via the unvalidated figwidth option of the figure directive. Attackers can append declarations like background:url to the rendered figure...

CVE-2026-115351

The Mistune markdown parser (versions 3.2.1 before 3.3.0 ) contains a CSS injection vulnerability (CWE-94). The issue stems from the unvalidated figwidth option within the figure directive , allowing attackers who control markdown input to inject arbitrary style declarations. Specifically, an att...

EUVD-2026-108420

Mistune from 3.2.1 before 3.3.0 contains a CSS injection vulnerability that allows attackers controlling markdown input to inject arbitrary style declarations via the unvalidated figwidth option of the figure directive. Attackers can append declarations like background:url to the rendered figure...

CVE-2026-115351 Mistune 3.2.1 before 3.3.0 CSS Injection via Figure Directive figwidth Option

Mistune from 3.2.1 before 3.3.0 contains a CSS injection vulnerability that allows attackers controlling markdown input to inject arbitrary style declarations via the unvalidated figwidth option of the figure directive. Attackers can append declarations like background:url to the rendered figure...

Mistune: XSS via unescaped figclass/figwidth in Figure directive

...

CVE-2026-44896 Mistune: XSS via unescaped figclass/figwidth in Figure directive

Mistune is a Python Markdown parser with renderers and plugins. In 3.2.0 and earlier, in src/mistune/directives/image.py, the renderfigure function concatenates figclass and figwidth options directly into HTML attributes without escaping. This allows attribute injection and XSS even when...

CVE-2026-44896 Mistune: XSS via unescaped figclass/figwidth in Figure directive

Mistune is a Python Markdown parser with renderers and plugins. In 3.2.0 and earlier, in src/mistune/directives/image.py, the renderfigure function concatenates figclass and figwidth options directly into HTML attributes without escaping. This allows attribute injection and XSS even when...

CVE-2026-44896 Mistune: XSS via unescaped figclass/figwidth in Figure directive

Mistune is a Python Markdown parser with renderers and plugins. In 3.2.0 and earlier, in src/mistune/directives/image.py, the renderfigure function concatenates figclass and figwidth options directly into HTML attributes without escaping. This allows attribute injection and XSS even when...

CVE-2026-44896

Mistune (Python Markdown parser) contains an XSS flaw in the image figure directive. In versions 3.2.0 and earlier, render_figure() concatenates figclass and figwidth into HTML attributes without escaping, allowing attribute injection and XSS even when HTMLRenderer(escape=True) is enabled, becaus...

GHSA-58CW-G322-P94V Mistune has XSS via unescaped figclass/figwidth in Figure directive

In src/mistune/directives/image.py, the renderfigure function concatenates figclass and figwidth options directly into HTML attributes without escaping lines 152-168. This allows attribute injection and XSS even when HTMLRendererescape=True is used, because these values bypass the inline renderer...

Mistune has XSS via unescaped figclass/figwidth in Figure directive

In src/mistune/directives/image.py, the renderfigure function concatenates figclass and figwidth options directly into HTML attributes without escaping lines 152-168. This allows attribute injection and XSS even when HTMLRendererescape=True is used, because these values bypass the inline renderer...