Threats Tagged 'cve-2026-59924'

In `src/mistune/directives/image.py`, the `render_figure()` function concatenates `figclass` and `figwidth` options directly into HTML attributes without escaping (lines 152-168). This allows attribute injection and XSS even when `HTMLRenderer(escape=True)` is used, because these values bypass the inline renderer. Other attributes in the same file (src, alt, style) are properly escaped; figclass/figwidth were missed.

A path traversal vulnerability exists in the mistune library's Include directive used by adr-viewer when processing markdown files. This flaw allows crafted include paths to access files outside the intended markdown directory. The vulnerability arises because the resolved file path is not properly validated to ensure it remains within a trusted base directory. Applications processing untrusted markdown with this directive enabled may inadvertently expose sensitive files accessible to the running process. A fix is available that involves validating the resolved path before file access.

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, Include.parse() joins and normalizes user-supplied include paths without verifying that the result remains within the intended markdown directory, allowing crafted include paths to access files outside that directory when markdown files are processed using md.read(). This issue is fixed in version 3.3.0.