Threats Tagged 'cve-2026-59923'

In `src/mistune/directives/image.py`, the `render_figure()` function concatenates `figclass` and `figwidth` options directly into HTML attributes without escaping (lines 152-168). This allows attribute injection and XSS even when `HTMLRenderer(escape=True)` is used, because these values bypass the inline renderer. Other attributes in the same file (src, alt, style) are properly escaped; figclass/figwidth were missed.

Mistune, a Markdown rendering library used in adr-viewer, contains a cross-site scripting (XSS) vulnerability in its safe_url() function. The function attempts to block harmful URL schemes like 'javascript:' by checking the URL prefix but fails to decode percent-encoded characters before this check. This allows an attacker to bypass the filter using percent-encoded 'javascript:' URIs, leading to execution of arbitrary JavaScript when a user clicks a crafted link. The vulnerability affects multiple specific versions of adr-viewer that use the vulnerable Mistune versions. The CVSS score is 6.1 (medium severity).

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, HTMLRenderer.safe_url() does not block percent-encoded javascript URIs, allowing attacker-supplied Markdown links or images to bypass URL protections and execute script in rendered HTML. This issue is fixed in version 3.3.0.