Skip to content
Lepture Mistune vulnerabilities
-
lepture mistune
Mistune before 3.3.3 Denial of Service via Balanced Bracket Link Parsing
CVE-2026-121438
Fix available
6.9 Medium
-
lepture mistune
Mistune 3.3.0 before 3.3.4 Quadratic-Time DoS via _process_emphasis_delimiters
CVE-2026-121437
8.7 High
-
lepture mistune
Mistune before 3.3.0 Path Traversal and XSS via Include Directive
CVE-2026-115355
Fix available
8.7 High
-
lepture mistune
Mistune before 3.3.0 Arbitrary Local File Read via Include Directive
CVE-2026-115354
7.1 High
-
lepture mistune
Mistune before 3.3.0 Path Traversal via include Directive
CVE-2026-115353
9.2 Critical
-
lepture mistune
Mistune before 3.3.0 Quadratic-Time DoS via Unmatched Brackets in Inline Parser
CVE-2026-115352
8.7 High
-
lepture mistune
Mistune 3.2.1 before 3.3.0 CSS Injection via Figure Directive figwidth Option
CVE-2026-115351
5.3 Medium
-
lepture mistune
Mistune before 3.3.0 Stored XSS via Include Directive HTML Files
CVE-2026-115350
5.3 Medium
-
lepture mistune
Mistune 3.0.0 before 3.3.0 Denial of Service via Nested Bracket Parsing
CVE-2026-115349
8.7 High
-
lepture mistune
Mistune before 3.3.0 Quadratic-Time DoS via parse_link_text
CVE-2026-115348
8.7 High
-
lepture mistune
Mistune before 3.3.0 Quadratic Denial of Service via parse_link_text
CVE-2026-115347
8.7 High
-
lepture mistune
Mistune has Denial of Service — RecursionError via Excessive Emphasis Markers in Markdown
CVE-2026-76098
Fix available
7.5 High
-
lepture mistune
Mistune directives/include: mutual `.. include::` recursion crashes the renderer with `RecursionError`, denial of service via two attacker-controlled markdown files
CVE-2026-59927
Fix available
5.3 Medium
-
lepture mistune
Mistune block_parser: quadratic-time parsing on long lists of repeated reference-link definitions
CVE-2026-59928
Fix available
7.5 High
-
lepture mistune
Mistune: Arbitrary File Read via Include directive path traversal
CVE-2026-59924
Fix available
5.9 Medium
-
lepture mistune
Mistune renderers/html.safe_url: HARMFUL_PROTOCOLS list misses legacy and chained schemes that historically chain to `javascript:` execution
CVE-2026-59929
Fix available
6.1 Medium
-
lepture mistune
inline_parser: quadratic-time parsing on long runs of `**x**` and `***x***` emphasis pairs
CVE-2026-59925
Fix available
7.5 High
-
lepture mistune
Mistune: XSS via unescaped class option in Admonition directive
CVE-2026-59926
Fix available
5.3 Medium
-
lepture mistune
Mistune: XSS via percent-encoded javascript URI bypass in safe_url()
CVE-2026-59923
Fix available
6.1 Medium
-
lepture mistune
Mistune toc / TableOfContents directive: heading IDs use predictable `toc_N` numbering with no slugification, allowing collision with attacker-controlled `id="toc_N"` content
CVE-2026-59930
Fix available
4.3 Medium
-
lepture mistune
Mistune plugins/formatting: quadratic-time parsing on long runs of `~~x~~`, `==x==`, and `^^x^^` markers (strikethrough / mark / insert)
CVE-2026-59922
Fix available
7.5 High
-
lepture mistune, red hat migration toolkit for applications 8, openshift ai (rhoai) +3 more +5 more
Mistune: Potential DoS via quadratic-time parsing in parse_link_text
CVE-2026-49851
Fix available
8.7 High
-
lepture mistune
Mistune Image Directive CSS Injection Vulnerability
CVE-2026-44899
Fix available
4.7 Medium
-
lepture mistune
Mistune TOC Anchor Injection XSS
CVE-2026-44898
Fix available
6.1 Medium
-
lepture mistune
Mistune Heading ID Attribute Injection XSS
CVE-2026-44897
Fix available
6.1 Medium
-
lepture mistune
Mistune: XSS via unescaped figclass/figwidth in Figure directive
CVE-2026-44896
Fix available
5.3 Medium
-
lepture mistune
Mistune Math Plugin XSS Escape Bypass
CVE-2026-44708
Fix available
6.1 Medium
-
lepture mistune, red hat migration toolkit for applications 8.2, openshift ai (rhoai) +2 more +4 more
Mistune ReDoS in LINK_TITLE_RE allows denial of service with crafted Markdown titles
CVE-2026-33079
Fix available
8.7 High