mistune vulnerabilities (Debian)
31 vulnerabilities.
-
mistuneDebian Mistune before 3.3.3 Denial of Service via Balanced Bracket Link Parsing 6.9 Medium -
mistuneDebian Mistune 3.3.0 before 3.3.4 Quadratic-Time DoS via _process_emphasis_delimiters 8.7 High -
mistuneDebian Mistune before 3.3.0 Path Traversal and XSS via Include Directive 8.7 High -
mistuneDebian Mistune before 3.3.0 Arbitrary Local File Read via Include Directive 7.1 High -
mistuneDebian Mistune before 3.3.0 Path Traversal via include Directive 9.2 Critical -
mistuneDebian Mistune before 3.3.0 Quadratic-Time DoS via Unmatched Brackets in Inline Parser 8.7 High -
mistuneDebian Mistune 3.2.1 before 3.3.0 CSS Injection via Figure Directive figwidth Option 5.3 Medium -
mistuneDebian Mistune before 3.3.0 Stored XSS via Include Directive HTML Files 5.3 Medium -
mistuneDebian Mistune 3.0.0 before 3.3.0 Denial of Service via Nested Bracket Parsing 8.7 High -
mistuneDebian Mistune before 3.3.0 Quadratic-Time DoS via parse_link_text 8.7 High -
mistuneDebian Mistune before 3.3.0 Quadratic Denial of Service via parse_link_text 8.7 High -
mistuneDebian Mistune has Denial of Service — RecursionError via Excessive Emphasis Markers in Markdown 7.5 High -
mistuneDebian Mistune directives/include: mutual `.. include::` recursion crashes the renderer with `RecursionError`, denial of service via two attacker-controlled markdown files 5.3 Medium -
mistuneDebian Mistune block_parser: quadratic-time parsing on long lists of repeated reference-link definitions 7.5 High -
mistuneDebian Mistune: Arbitrary File Read via Include directive path traversal 5.9 Medium -
mistuneDebian Mistune renderers/html.safe_url: HARMFUL_PROTOCOLS list misses legacy and chained schemes that historically chain to `javascript:` execution 6.1 Medium -
mistuneDebian inline_parser: quadratic-time parsing on long runs of `**x**` and `***x***` emphasis pairs 7.5 High -
mistuneDebian Mistune: XSS via unescaped class option in Admonition directive 5.3 Medium -
mistuneDebian Mistune: XSS via percent-encoded javascript URI bypass in safe_url() 6.1 Medium -
mistuneDebian Mistune toc / TableOfContents directive: heading IDs use predictable `toc_N` numbering with no slugification, allowing collision with attacker-controlled `id="toc_N"` content 4.3 Medium -
mistuneDebian Mistune plugins/formatting: quadratic-time parsing on long runs of `~~x~~`, `==x==`, and `^^x^^` markers (strikethrough / mark / insert) 7.5 High -
mistuneDebian Mistune: Potential DoS via quadratic-time parsing in parse_link_text 8.7 High -
mistuneDebian Mistune Image Directive CSS Injection Vulnerability 4.7 Medium -
mistuneDebian Mistune TOC Anchor Injection XSS 6.1 Medium -
mistuneDebian Mistune Heading ID Attribute Injection XSS 6.1 Medium -
mistuneDebian Mistune: XSS via unescaped figclass/figwidth in Figure directive 5.3 Medium -
mistuneDebian Mistune Math Plugin XSS Escape Bypass 6.1 Medium -
mistuneDebian Mistune ReDoS in LINK_TITLE_RE allows denial of service with crafted Markdown titles 8.7 High -
mistuneDebian Mistune vulnerable to catastrophic backtracking 7.5 High -
mistuneDebian mistune Cross-site scripting (XSS) vulnerability 6.1 Medium -
mistuneDebian Cross-site Scripting in Mistune 6.1 Medium