Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

mistune — Vulnerabilities & Security Advisories 17

All 17 CVE vulnerabilities found in mistune, with AI-generated Chinese analysis, references, and POCs.

This page aggregates Common Weakness Enumeration records specifically for the mistune Python markdown parser developed by hupan. It serves as a centralized reference for identifying security flaws within this widely used static analysis and conversion tool, focusing on the technical characteristics of the identified weaknesses rather than their narrative impact. The content herein compiles a comprehensive list of CVE entries, detailing the nature of the bugs, their severity ratings, and the specific versions affected. This collection spans from the early iterations of the library through to its most recent stable releases, ensuring a historical perspective on how security issues have evolved or been resolved over time. By browsing this aggregation, users can track the vendor’s historical advisory patterns to assess their responsiveness to security reports. Developers and security analysts can gain a deeper understanding of common vulnerability classes associated with markdown parsing libraries by examining the recurring failure modes in mistune. Additionally, stakeholders can look up the complete vulnerability history of the product to determine if their current deployment version is exposed to any known issues. This resource is designed to support risk assessment and patch management decisions by providing transparent, structured data about the security posture of the mistune project. It allows for the correlation of weaknesses with specific release cycles, facilitating better informed maintenance strategies. The focus remains strictly on factual reporting and technical classification to assist in accurate threat modeling and remediation planning for systems relying on this software component.

Vendor: lepture

CVE ID Title CVSS Severity Published
CVE-2026-76098 Mistune has Denial of Service — RecursionError via Excessive Emphasis Markers in Markdown CWE-674 7.5 High 2026-08-24
CVE-2026-59927 Mistune directives/include: mutual `.. include::` recursion crashes the renderer with `RecursionError`, denial of service via two attacker-controlled markdown files CWE-674 5.3 Medium 2026-07-08
CVE-2026-59928 Mistune block_parser: quadratic-time parsing on long lists of repeated reference-link definitions CWE-407 7.5 High 2026-07-08
CVE-2026-59924 Mistune: Arbitrary File Read via Include directive path traversal CWE-22 5.9 Medium 2026-07-08
CVE-2026-59929 Mistune renderers/html.safe_url: HARMFUL_PROTOCOLS list misses legacy and chained schemes that historically chain to `javascript:` execution CWE-79 6.1 Medium 2026-07-08
CVE-2026-59925 inline_parser: quadratic-time parsing on long runs of `**x**` and `***x***` emphasis pairs CWE-407 7.5 High 2026-07-08
CVE-2026-59926 Mistune: XSS via unescaped class option in Admonition directive CWE-79 - - 2026-07-08
CVE-2026-59923 Mistune: XSS via percent-encoded javascript URI bypass in safe_url() CWE-79 6.1 Medium 2026-07-08
CVE-2026-59930 Mistune toc / TableOfContents directive: heading IDs use predictable `toc_N` numbering with no slugification, allowing collision with attacker-controlled `id="toc_N"` content CWE-345 4.3 Medium 2026-07-08
CVE-2026-59922 Mistune plugins/formatting: quadratic-time parsing on long runs of `~~x~~`, `==x==`, and `^^x^^` markers (strikethrough / mark / insert) CWE-407 7.5 High 2026-07-08
CVE-2026-49851 Mistune: Potential DoS via quadratic-time parsing in parse_link_text CWE-400 8.7 High 2026-06-24
CVE-2026-44898 Mistune TOC Anchor Injection XSS CWE-79 6.1 Medium 2026-05-26
CVE-2026-44897 Mistune Heading ID Attribute Injection XSS CWE-79 6.1 Medium 2026-05-26
CVE-2026-44708 Mistune Math Plugin XSS Escape Bypass CWE-79 6.1 Medium 2026-05-26
CVE-2026-44899 Mistune Image Directive CSS Injection Vulnerability CWE-79 4.7 Medium 2026-05-26
CVE-2026-44896 Mistune: XSS via unescaped figclass/figwidth in Figure directive CWE-79 - - 2026-05-26
CVE-2026-33079 Mistune ReDoS in LINK_TITLE_RE allows denial of service with crafted Markdown titles CWE-1333 8.7 High 2026-05-06

All 17 known CVE vulnerabilities affecting mistune with full Chinese analysis, references, and POCs where available.