5.3
Medium
CVE-2026-115351 Mistune from 3.2.1 before 3.3.0 contains a CSS injection vulnerability that allows attackers controlling markdown…
Description
Mistune from 3.2.1 before 3.3.0 contains a CSS injection vulnerability that allows attackers controlling markdown input to inject arbitrary style declarations via the unvalidated figwidth option of the figure directive. Attackers can append declarations like background:url() to the rendered figure style attribute, forcing victim browsers to send requests to attacker servers and leak attribute values.
Affected products and versions
Other CVEs of mistune
The 28 CVEs of mistune →
CVE-2026-121437
Mistune from 3.3.0 before 3.3.4 contains a denial of service vulnerability that allows remote attackers to exhaust CPU…
8.7
High
CVE-2026-121438
Mistune before 3.3.3 Denial of Service via Balanced Bracket Link Parsing
6.9
Medium
CVE-2026-115355
Mistune before 3.3.0 contains a path traversal vulnerability in the Include directive that allows attackers to read…
8.7
High
CVE-2026-115354
Mistune before 3.3.0 contains a path traversal vulnerability in the opt-in Include directive that allows attackers to…
7.1
High