CVE-2026-44899
MEDIUM
4,7
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: required
Scope: changed
Confidentiality: low
Integrity: none
Availability: none
Description
AI Translation Available
Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.2.1, the Image directive plugin validates the :width: and :height: options with a regex compiled as _num_re = re.compile(r'^\d+(?:\.\d*)?'). When the validated value is not a plain integer, render_block_image() inserts it directly into a style='width:...;' or style='height:...;' attribute. Because the value was accepted by the prefix-only regex, any CSS after the leading digits reaches the style= attribute verbatim and without escaping. This vulnerability is fixed in 3.2.1.
79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
StableCommon Consequences
Security Scopes Affected:
Access Control
Confidentiality
Integrity
Availability
Potential Impacts:
Bypass Protection Mechanism
Read Application Data
Execute Unauthorized Code Or Commands
Applicable Platforms
Technologies:
AI/ML, Web Based, Web Server
https://github.com/lepture/mistune/releases/tag/v3.2.1
https://github.com/lepture/mistune/security/advisories/GHSA-ccfx-mfmx-2fx9