SEC.co
Emergency

By vendor

Mistune_project vulnerabilities

Known CVEs affecting Mistune_project products, prioritized by severity, with SEC.co remediation and detection guidance.

9 published vulnerabilities

Known exploited (KEV)CriticalHighMediumAll recent
  • CVE-2026-59922HIGH 7.5

    Mistune, a popular Python Markdown parser, contains a performance vulnerability in its formatting plugins that can be exploited to cause denial of service. When processing specially crafted Markdown input containing repeated tilde (~), equals (=), or caret (^) characters, the strikethrough, mark, or insert plugins perform excessive computational work. An attacker can send malicious Markdown to applications using vulnerable versions, exhausting server CPU resources and making the service unavailable to legitimate users. This issue affects all versions prior to 3.3.0 and is fixed in that release.

  • CVE-2026-59925HIGH 7.5

    Mistune, a widely-used Python Markdown parser, contains a denial-of-service vulnerability in how it handles emphasis formatting. When processing certain malformed or adversarially crafted Markdown with long sequences of double or triple asterisks (used for bold and italic emphasis), the parser performs redundant scanning that grows quadratically with input length. An attacker can exploit this by sending specially crafted Markdown to any system parsing it with vulnerable Mistune versions, causing the parser to consume excessive CPU and potentially crash or hang the application. Version 3.3.0 eliminates the performance cliff.

  • CVE-2026-59928HIGH 7.5

    Mistune, a widely-used Python Markdown parser library, contains a denial-of-service vulnerability in how it handles Markdown reference-link definitions. An attacker can craft a malicious Markdown document with numerous repeated or distinct reference links that forces the parser to perform excessive computational work, ultimately exhausting CPU resources and crashing or hanging applications that parse untrusted Markdown input. The vulnerability has been patched in version 3.3.0.

  • CVE-2026-59923MEDIUM 6.1

    Mistune, a widely-used Python library for converting Markdown to HTML, contains a flaw in how it validates links and image URLs. An attacker can craft Markdown that includes specially encoded JavaScript commands disguised in percent-encoded format. When a user renders this malicious Markdown through Mistune versions before 3.3.0, the library fails to block these hidden scripts, allowing them to execute in the browser. This affects any application that accepts user-supplied Markdown and displays the rendered output to other users.

  • CVE-2026-59926MEDIUM 6.1

    Mistune, a popular Python library for converting Markdown into HTML, has a vulnerability in how it handles formatting directives. When users include special formatting instructions (called admonitions) in Markdown, the library failed to properly clean certain styling options before adding them to the generated HTML. This oversight allows an attacker to inject malicious code that could compromise website visitors' browsers, even if the site owner thought they had protective settings turned on. The issue affects Mistune versions before 3.2.1.

  • CVE-2026-59929MEDIUM 6.1

    Mistune, a popular Python Markdown parser, contains a vulnerability in its URL sanitization logic that fails to block certain legacy and less-common URL schemes. While it successfully blocks javascript:, vbscript:, file:, and data: URLs, attackers can bypass this protection by using alternative schemes like feed:, view-source:, jar:, or others to inject malicious links into rendered HTML. When users click these links or the content is processed by certain browsers, script execution may occur. This affects Mistune versions prior to 3.3.0.

  • CVE-2026-59924MEDIUM 5.9

    Mistune, a popular Python Markdown parser, contains a path traversal vulnerability in its Include.parse() function. When processing markdown files that reference external files via include statements, the parser fails to properly validate that included file paths remain within the intended markdown directory. An attacker can craft specially designed include paths to escape the intended directory and read arbitrary files from the system. The vulnerability affects Mistune versions prior to 3.3.0 and is resolved in version 3.3.0 and later.

  • CVE-2026-59927MEDIUM 5.3

    Mistune, a popular Python Markdown parser, contains a flaw in how it handles file inclusion directives. When two Markdown files are set up to include each other (either directly or through a chain), the parser enters an infinite loop trying to resolve the circular reference. This causes the application to crash with a RecursionError rather than gracefully detecting and rejecting the cycle. The vulnerability was introduced because the inclusion logic only checked for immediate self-references but missed indirect circular dependencies. The issue affects all versions prior to 3.3.0.

  • CVE-2026-59930MEDIUM 4.3

    Mistune, a popular Python Markdown parser, contains a predictability flaw in how it generates anchor IDs for table-of-contents elements. Before version 3.3.0, the toc plugin and TableOfContents directive create heading IDs using a simple sequential pattern (toc_1, toc_2, etc.) without considering the actual heading text. An attacker who controls Markdown content can craft headings with matching IDs that collide with these predictable anchors, potentially redirecting users to unintended locations or interfering with page navigation and styling rules that depend on those IDs.