Mistune Project Mistune vulnerabilities

• lepture mistune Mistune directives/include: mutual `.. include::` recursion crashes the renderer with `RecursionError`, denial of service via two attacker-controlled markdown files CVE-2026-59927 Fix available 5.3 MediumJuly 8, 2026
• lepture mistune Mistune block_parser: quadratic-time parsing on long lists of repeated reference-link definitions CVE-2026-59928 Fix available 7.5 HighJuly 8, 2026
• lepture mistune Mistune: Arbitrary File Read via Include directive path traversal CVE-2026-59924 Fix available 5.9 MediumJuly 8, 2026
• lepture mistune Mistune renderers/html.safe_url: HARMFUL_PROTOCOLS list misses legacy and chained schemes that historically chain to `javascript:` execution CVE-2026-59929 Fix available 6.1 MediumJuly 8, 2026
• lepture mistune inline_parser: quadratic-time parsing on long runs of `**x**` and `***x***` emphasis pairs CVE-2026-59925 Fix available 7.5 HighJuly 8, 2026
• lepture mistune Mistune: XSS via unescaped class option in Admonition directive CVE-2026-59926 Fix available 5.3 MediumJuly 8, 2026
• lepture mistune Mistune: XSS via percent-encoded javascript URI bypass in safe_url() CVE-2026-59923 Fix available 6.1 MediumJuly 8, 2026
• lepture mistune Mistune toc / TableOfContents directive: heading IDs use predictable `toc_N` numbering with no slugification, allowing collision with attacker-controlled `id="toc_N"` content CVE-2026-59930 Fix available 4.3 MediumJuly 8, 2026
• lepture mistune Mistune plugins/formatting: quadratic-time parsing on long runs of `~~x~~`, `==x==`, and `^^x^^` markers (strikethrough / mark / insert) CVE-2026-59922 Fix available 7.5 HighJuly 8, 2026
• lepture mistune Mistune Image Directive CSS Injection Vulnerability CVE-2026-44899 Fix available 4.7 MediumMay 14, 2026
• lepture mistune Mistune TOC Anchor Injection XSS CVE-2026-44898 Fix available 6.1 MediumMay 14, 2026
• lepture mistune Mistune Heading ID Attribute Injection XSS CVE-2026-44897 Fix available 6.1 MediumMay 9, 2026
• lepture mistune Mistune: XSS via unescaped figclass/figwidth in Figure directive CVE-2026-44896 Fix available 5.3 MediumMay 8, 2026
• lepture mistune Mistune Math Plugin XSS Escape Bypass CVE-2026-44708 Fix available 6.1 MediumMay 8, 2026
• mistune project mistune, fedoraproject fedora +1 more Mistune vulnerable to catastrophic backtracking CVE-2022-34749 Fix available 7.5 HighJuly 25, 2022
• mistune project mistune, fedoraproject fedora +1 more mistune Cross-site scripting (XSS) vulnerability CVE-2017-16876 Fix available 6.1 MediumDecember 29, 2017
• mistune project mistune Cross-site Scripting in Mistune CVE-2017-15612 Fix available 6.1 MediumOctober 19, 2017