Threat database

Mistune versions before 3.3.0 have a path traversal vulnerability in the Include directive that allows attackers to read arbitrary files by using ../ sequences. Additionally, attackers can inject HTML via unescaped error messages and included file contents, enabling cross-site scripting even when escape=True is set. This vulnerability has a high severity rating with a CVSS score of 8.7.

Mistune versions before 3.3.0 have a path traversal vulnerability in the opt-in Include directive. This flaw allows attackers to read arbitrary local files by providing relative or absolute paths. Exploitation can lead to disclosure of sensitive files such as /etc/passwd and injection of unescaped HTML or script content into rendered Markdown output.

Mistune versions before 3.3.0 contain a critical path traversal vulnerability in the RST include directive. This flaw allows attackers to read arbitrary files by using relative or absolute paths in markdown include directives. Exploitation can lead to exposure of sensitive files such as credentials or environment data embedded in rendered HTML.

Mistune before 3.3.0 contains an algorithmic complexity vulnerability in the inline link parser that allows unauthenticated attackers to exhaust CPU by submitting long runs of unmatched '[' characters. Attackers can send small markdown payloads that trigger O(N^2) parse_link_text and parse_link_label probing, occupying rendering workers for 30+ seconds per 16 KB input.

Mistune versions from 3.2.1 up to but not including 3.3.0 contain a CSS injection vulnerability via the unvalidated figwidth option in the figure directive. This allows attackers controlling markdown input to inject arbitrary CSS style declarations, potentially causing victim browsers to send requests to attacker-controlled servers and leak attribute values. The vulnerability has a medium severity with a CVSS 4.0 score of 5.3.

Mistune versions before 3.3.0 have a cross-site scripting (XSS) vulnerability in the Include directive. This directive emits included HTML content as raw block_html tokens without proper neutralization. An attacker who can place a readable HTML file on the system can exploit this by referencing it with an include directive combined with path traversal, leading to stored script execution when escape=False is set.

Mistune versions 3.0.0 up to but not including 3.3.0 contain a denial of service vulnerability caused by inefficient regular expression handling in the parse_link_text function. This flaw allows attackers to craft markdown input with deeply nested square brackets, triggering quadratic parsing time and potentially exhausting server CPU resources.

Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity vulnerability in the inline link parser's parse_link_text function that allows unauthenticated attackers to exhaust CPU with unbalanced brackets. Attackers can submit Markdown containing many unbalanced '[' or '![' characters, forcing repeated unbounded forward scans and tying up worker processes for minutes.

Mistune versions before 3.3.0 have an inefficient algorithmic complexity vulnerability in the parse_link_text function. This flaw allows remote attackers to cause denial of service by submitting markdown with long runs of unmatched square brackets. The vulnerability triggers repeated forward scans that stall worker processes for minutes, leading to service disruption.

Mistune versions 3.3.0 through 3.3.2 contain a denial-of-service vulnerability caused by uncontrolled recursion during HTML rendering of deeply nested emphasis tokens. This can trigger a Python RecursionError and crash the parsing process. The issue is resolved in version 3.3.3.

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, the Include directive in src/mistune/directives/include.py detects only direct self-includes and not indirect cycles, allowing two markdown files that include each other to trigger unbounded recursion, raise RecursionError, and crash the rendering request. This issue is fixed in version 3.3.0.

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, a Markdown document containing many repeated or distinct reference-link definitions causes quadratic work in src/mistune/block_parser.py and the ref_links environment dictionary handling, allowing denial of service through CPU exhaustion. This issue is fixed in version 3.3.0.

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, Include.parse() joins and normalizes user-supplied include paths without verifying that the result remains within the intended markdown directory, allowing crafted include paths to access files outside that directory when markdown files are processed using md.read(). This issue is fixed in version 3.3.0.

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, the safe_url filter in src/mistune/renderers/html.py blocks only javascript:, vbscript:, file:, and data: schemes, allowing legacy or chained schemes such as feed:, view-source:, jar:, livescript:, mocha:, ms-its:, mk:, and res: to reach rendered href and src attributes and potentially execute script in affected user agents. This issue is fixed in version 3.3.0.

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, long sequences of well-formed double-asterisk or triple-asterisk emphasis pairs around a character cause quadratic work in src/mistune/inline_parser.py because the parser scans forward for matching close markers from every potential opening run, allowing denial of service in default Mistune parsing. This issue is fixed in version 3.3.0.

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.2.1, render_admonition() in src/mistune/directives/admonition.py concatenates the Admonition directive :class: option into the HTML class attribute without escaping, allowing attribute injection and cross-site scripting even when HTMLRenderer escape mode is enabled. This issue is fixed in version 3.2.1.

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, HTMLRenderer.safe_url() does not block percent-encoded javascript URIs, allowing attacker-supplied Markdown links or images to bypass URL protections and execute script in rendered HTML. This issue is fixed in version 3.3.0.

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, the toc plugin and TableOfContents directive generate heading IDs as predictable toc_N values without slugifying the heading text, allowing attacker-controlled id="toc_N" content to collide with generated anchors and redirect same-page navigation, CSS selectors, or JavaScript handlers. This issue is fixed in version 3.3.0.

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, a run of closed tilde, equals-sign, or caret marker pairs around a character causes quadratic work in src/mistune/plugins/formatting.py when the strikethrough, mark, or insert plugin scans for matching markers from each possible start position, allowing denial of service through CPU exhaustion. This issue is fixed in version 3.3.0.

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, Mistune is vulnerable to a CPU exhaustion DoS due to superlinear (approximately O(n²)) behavior in parse_link_text. When parsing Markdown containing many consecutive [ characters, parse_link_text repeatedly scans the input using a regex search inside a loop. Each iteration re-scans a large portion of the remaining string, resulting in quadratic-time behavior. An attacker-controlled Markdown input can therefore trigger excessive CPU usage with a very small payload. This vulnerability is fixed in 3.3.0.