Threats Tagged 'cve-2026-59927'

In `src/mistune/directives/image.py`, the `render_figure()` function concatenates `figclass` and `figwidth` options directly into HTML attributes without escaping (lines 152-168). This allows attribute injection and XSS even when `HTMLRenderer(escape=True)` is used, because these values bypass the inline renderer. Other attributes in the same file (src, alt, style) are properly escaped; figclass/figwidth were missed.

A vulnerability in the adr-viewer product using the mistune markdown renderer's Include directive allows uncontrolled recursion via mutual inclusion of markdown files. Two markdown files that include each other cause unbounded recursion, triggering a Python RecursionError that crashes the renderer and results in denial of service. The issue arises because the Include directive only detects direct self-inclusion but not indirect cycles. This vulnerability affects multiple specified versions of adr-viewer and has a medium severity rating with a CVSS score of 5.3. A patch is available to fix this issue by tracking included files and preventing recursive cycles.

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, the Include directive in src/mistune/directives/include.py detects only direct self-includes and not indirect cycles, allowing two markdown files that include each other to trigger unbounded recursion, raise RecursionError, and crash the rendering request. This issue is fixed in version 3.3.0.