Threats Tagged 'cve-2026-59925'

In `src/mistune/directives/image.py`, the `render_figure()` function concatenates `figclass` and `figwidth` options directly into HTML attributes without escaping (lines 152-168). This allows attribute injection and XSS even when `HTMLRenderer(escape=True)` is used, because these values bypass the inline renderer. Other attributes in the same file (src, alt, style) are properly escaped; figclass/figwidth were missed.

CVE-2026-59925 is a high-severity algorithmic-complexity denial-of-service (DoS) vulnerability in the adr-viewer product's use of the mistune markdown parser. The flaw arises from quadratic-time parsing of long sequences of emphasis markers like '**x**' or '***x***' in markdown input, causing excessive CPU usage. This vulnerability affects default mistune configurations with no plugins required and can be triggered by attacker-supplied markdown. The issue is due to the parser scanning for matching emphasis closers from every potential start position, resulting in O(N²) work. A patch is available that caps the number of unmatched opening emphasis markers to restore linear-time parsing.

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, long sequences of well-formed double-asterisk or triple-asterisk emphasis pairs around a character cause quadratic work in src/mistune/inline_parser.py because the parser scans forward for matching close markers from every potential opening run, allowing denial of service in default Mistune parsing. This issue is fixed in version 3.3.0.