Mistune has a ReDoS in LINK_TITLE_RE that allows denial of service via crafted Markdown input

SummaryA ReDoS Regular Expression Denial of Service vulnerability in LINKTITLERE allows an attacker who can supply Markdown for parsing to cause denial of service. A crafted 58-byte Markdown document blocks the parser for approximately 6 seconds measured on Apple M2, Python 3.14.3, with exponenti...

PT-2026-59301

Summary A ReDoS Regular Expression Denial of Service vulnerability in LINK TITLE RE allows an attacker who can supply Markdown for parsing to cause denial of service. A crafted 58-byte Markdown document blocks the parser for approximately 6 seconds measured on Apple M2, Python 3.14.3, with...

AZL-86318 CVE-2026-33079 affecting package python-mistune for versions less than 3.2.1-1

In versions 3.0.0a1 through 3.2.0 of Mistune, there is a ReDoS Regular Expression Denial of Service vulnerability in LINKTITLERE that allows an attacker who can supply Markdown for parsing to cause denial of service. The regular expression used for parsing link titles contains overlapping...

PT-2026-38088

Name of the Vulnerable Software and Affected Versions Mistune versions 3.0.0a1 through 3.2.0 Description A Regular Expression Denial of Service ReDoS exists in the LINK TITLE RE regular expression. An attacker can provide specially crafted Markdown for parsing that triggers catastrophic...

BIT-REDMINE-2020-36307

Redmine before 4.0.7 and 4.1.x before 4.1.1 has stored XSS via textile inline links...

Cross-Site Scripting (XSS)

Redmine is vulnerable to cross-site scripting XSS. An attacker is able to inject and execute arbitrary Javascript in a user's browser via textile inline links...

Redmine Cross-Site Scripting Vulnerability (CNVD-2021-27366)

Redmine is an open source, web-based project management and defect tracking tool. A stored cross-site scripting vulnerability exists in Redmine. An attacker can exploit this vulnerability via textile inline links to conduct cross-site scripting attacks...

CVE-2020-36307

Redmine before 4.0.7 and 4.1.x before 4.1.1 has stored XSS via textile inline links...

CVE-2020-36307

Redmine before 4.0.7 and 4.1.x before 4.1.1 has stored XSS via textile inline links...

Cross site scripting

Redmine before 4.0.7 and 4.1.x before 4.1.1 has stored XSS via textile inline links...

CVE-2020-36307

Redmine before 4.0.7 and 4.1.x before 4.1.1 has stored XSS via textile inline links...

CVE-2020-36307

Redmine before 4.0.7 and 4.1.x before 4.1.1 has stored XSS via textile inline links...

CVE-2020-36307

CVE-2020-36307 affects Redmine before 4.0.7 and Redmine 4.1.x before 4.1.1, with a stored XSS flaw via textile inline links. Several connected sources corroborate the vulnerability as a stored cross‑site scripting issue in Redmine’s web UI. Debian LTS advisories cite a patched Redmine version (3....

CVE-2020-36307: Improper Neutralization of Input During Web Page Generation

Redmine before 4.0.7 and 4.1.x before 4.1.1 has stored XSS via textile inline links...

PT-2021-4536 · Redmine · Redmine

Name of the Vulnerable Software and Affected Versions: Redmine versions 4.0.0 through 4.0.6 Redmine versions 4.1.0 through 4.1.0 Description: The issue is related to stored XSS via textile inline links, which can be exploited by a remote attacker to impact data integrity. The vulnerability is due...