Mistune is a Python Markdown parser with support for renderers and plugins, including a math plugin that renders inline and block math expressions. In versions before 3.2.1, the math plugin inserts user-supplied content directly into HTML output without escaping, violating the expected behavior of escape=True which should sanitize user input. This improper neutralization of input during web page generation (CWE-79) allows an attacker to inject malicious scripts, resulting in a cross-site scripting vulnerability. The vulnerability has a CVSS 3.1 base score of 6.1, indicating a medium severity level. The vulnerability is resolved in version 3.2.1 of mistune.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the victim's browser when viewing content rendered by the vulnerable mistune math plugin. This can lead to limited confidentiality and integrity impacts such as theft of user data or manipulation of displayed content. There is no indication of availability impact. No known exploits in the wild have been reported as of the publication date.

Upgrade mistune to version 3.2.1 or later, where this vulnerability is fixed. Since the vulnerability is addressed in this official release, applying this update is the recommended remediation. Patch status is confirmed fixed in 3.2.1. No additional mitigations are specified or required.