Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%

mistune — Vulnerabilities & Security Advisories 16

All 16 CVE vulnerabilities found in mistune, with AI-generated Chinese analysis, references, and POCs.

This page documents security vulnerabilities associated with the Mistune Markdown parser, categorizing them under common weakness enumeration tags related to injection and parsing errors. It aggregates a comprehensive collection of known security flaws affecting this specific Python library, covering the historical record from its initial releases through recent updates. By centralizing this data, the page allows researchers and developers to track vendor advisories and understand the specific characteristics of weakness classes such as improper input validation or regular expression denial of service attacks that have impacted this tool. Users can look up the complete vulnerability history of Mistune to assess the severity and evolution of these issues over time, facilitating better risk management and remediation strategies. The content includes details on affected versions, reported impact, and contextual information provided by security databases, ensuring that practitioners have access to accurate and up-to-date intelligence. This resource serves as a reference for identifying potential risks in projects that rely on Mistune for text processing, helping teams maintain secure codebases by addressing known weaknesses before they can be exploited. The aggregated data is organized to support efficient querying and analysis, providing a clear overview of the security landscape surrounding this popular markdown parsing utility without overwhelming the reader with redundant information or unverified claims.

Vendor: lepture

CVE IDTitleCVSSSeverityPublished
CVE-2026-59927 Mistune directives/include: mutual `.. include::` recursion crashes the renderer with `RecursionError`, denial of service via two attacker-controlled markdown files CWE-674 5.3 Medium2026-07-08
CVE-2026-59928 Mistune block_parser: quadratic-time parsing on long lists of repeated reference-link definitions CWE-407 7.5 High2026-07-08
CVE-2026-59924 Mistune: Arbitrary File Read via Include directive path traversal CWE-22 5.9 Medium2026-07-08
CVE-2026-59929 Mistune renderers/html.safe_url: HARMFUL_PROTOCOLS list misses legacy and chained schemes that historically chain to `javascript:` execution CWE-79 6.1 Medium2026-07-08
CVE-2026-59925 inline_parser: quadratic-time parsing on long runs of `**x**` and `***x***` emphasis pairs CWE-407 7.5 High2026-07-08
CVE-2026-59926 Mistune: XSS via unescaped class option in Admonition directive CWE-79--2026-07-08
CVE-2026-59923 Mistune: XSS via percent-encoded javascript URI bypass in safe_url() CWE-79 6.1 Medium2026-07-08
CVE-2026-59930 Mistune toc / TableOfContents directive: heading IDs use predictable `toc_N` numbering with no slugification, allowing collision with attacker-controlled `id="toc_N"` content CWE-345 4.3 Medium2026-07-08
CVE-2026-59922 Mistune plugins/formatting: quadratic-time parsing on long runs of `~~x~~`, `==x==`, and `^^x^^` markers (strikethrough / mark / insert) CWE-407 7.5 High2026-07-08
CVE-2026-49851 Mistune: Potential DoS via quadratic-time parsing in parse_link_text CWE-400--2026-06-24
CVE-2026-44898 Mistune TOC Anchor Injection XSS CWE-79 6.1 Medium2026-05-26
CVE-2026-44897 Mistune Heading ID Attribute Injection XSS CWE-79 6.1 Medium2026-05-26
CVE-2026-44708 Mistune Math Plugin XSS Escape Bypass CWE-79 6.1 Medium2026-05-26
CVE-2026-44899 Mistune Image Directive CSS Injection Vulnerability CWE-79 4.7 Medium2026-05-26
CVE-2026-44896 Mistune: XSS via unescaped figclass/figwidth in Figure directive CWE-79--2026-05-26
CVE-2026-33079 Mistune ReDoS in LINK_TITLE_RE allows denial of service with crafted Markdown titles CWE-1333 7.5AIHighAI2026-05-06

All 16 known CVE vulnerabilities affecting mistune with full Chinese analysis, references, and POCs where available.