5.3
Moyenne
CVE-2026-115351 Mistune from 3.2.1 before 3.3.0 contains a CSS injection vulnerability that allows attackers controlling markdown…
Description
Mistune from 3.2.1 before 3.3.0 contains a CSS injection vulnerability that allows attackers controlling markdown input to inject arbitrary style declarations via the unvalidated figwidth option of the figure directive. Attackers can append declarations like background:url() to the rendered figure style attribute, forcing victim browsers to send requests to attacker servers and leak attribute values.
Produits et versions touchés
Autres CVE de mistune
Les 28 CVE de mistune →
CVE-2026-121437
Mistune from 3.3.0 before 3.3.4 contains a denial of service vulnerability that allows remote attackers to exhaust CPU…
8.7
Élevée
CVE-2026-121438
Mistune before 3.3.3 Denial of Service via Balanced Bracket Link Parsing
6.9
Moyenne
CVE-2026-115355
Mistune before 3.3.0 contains a path traversal vulnerability in the Include directive that allows attackers to read…
8.7
Élevée
CVE-2026-115354
Mistune before 3.3.0 contains a path traversal vulnerability in the opt-in Include directive that allows attackers to…
7.1
Élevée