Home

Description

Mistune is a Python Markdown parser with renderers and plugins. In 3.2.0 and earlier, in src/mistune/directives/image.py, the render_figure() function concatenates figclass and figwidth options directly into HTML attributes without escaping. This allows attribute injection and XSS even when HTMLRenderer(escape=True) is used, because these values bypass the inline renderer. Version 3.2.1 contains a patch.

PUBLISHED Reserved 2026-05-07 | Published 2026-05-26 | Updated 2026-06-08 | Assigner GitHub_M




MEDIUM: 5.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Problem types

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Product status

< 3.2.1
affected

References

github.com/...istune/security/advisories/GHSA-58cw-g322-p94v

github.com/...ommit/a3cb6e5655308797e8be021d6c7b5bab13cbace2

cve.org (CVE-2026-44896)

nvd.nist.gov (CVE-2026-44896)

Download JSON