lepture mistune
26 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-115355 | < 3.3.0 | Mistune before 3.3.0 Path Traversal and XSS via Include Directive | HIGH 8.7 | 0.5 % | ||
| CVE-2026-115354 | < 3.3.0 | Mistune before 3.3.0 Arbitrary Local File Read via Include Directive | HIGH 7.1 | 0.5 % | ||
| CVE-2026-115353 | < 3.3.0 | Mistune before 3.3.0 Path Traversal via include Directive | CRITICAL 9.2 | 0.4 % | ||
| CVE-2026-115352 | < 3.3.0 | Mistune before 3.3.0 Quadratic-Time DoS via Unmatched Brackets in Inline Parser | HIGH 8.7 | 0.4 % | ||
| CVE-2026-115351 | 3.2.1 – < 3.3.0 | Mistune 3.2.1 before 3.3.0 CSS Injection via Figure Directive figwidth Option | MEDIUM 5.3 | 0.2 % | ||
| CVE-2026-115350 | < 3.3.0 | Mistune before 3.3.0 Stored XSS via Include Directive HTML Files | MEDIUM 5.3 | 0.2 % | ||
| CVE-2026-115349 | 3.0.0 – < 3.3.0 | Mistune 3.0.0 before 3.3.0 Denial of Service via Nested Bracket Parsing | HIGH 8.7 | 0.3 % | ||
| CVE-2026-115348 | 3.0.0 – < 3.3.0 | Mistune before 3.3.0 Quadratic-Time DoS via parse_link_text | HIGH 8.7 | 0.4 % | ||
| CVE-2026-115347 | < 3.3.0 | Mistune before 3.3.0 Quadratic Denial of Service via parse_link_text | HIGH 8.7 | 0.4 % | ||
| CVE-2026-76098 | >= 3.3.0, < 3.3.3 | Mistune has Denial of Service — RecursionError via Excessive Emphasis Markers in Markdown | HIGH 7.5 | 0.5 % | ||
| CVE-2026-59927 | < 3.3.0 | Mistune directives/include: mutual `.. include::` recursion crashes the renderer with `RecursionError`, denial of service via two attacke… | MEDIUM 5.3 | 0.5 % | ||
| CVE-2026-59928 | < 3.3.0 | Mistune block_parser: quadratic-time parsing on long lists of repeated reference-link definitions | HIGH 7.5 | 0.7 % | ||
| CVE-2026-59924 | < 3.3.0 | Mistune: Arbitrary File Read via Include directive path traversal | MEDIUM 5.9 | 0.5 % | ||
| CVE-2026-59929 | < 3.3.0 | Mistune renderers/html.safe_url: HARMFUL_PROTOCOLS list misses legacy and chained schemes that historically chain to `javascript:` execution | MEDIUM 6.1 | 0.3 % | ||
| CVE-2026-59925 | < 3.3.0 | inline_parser: quadratic-time parsing on long runs of `**x**` and `***x***` emphasis pairs | HIGH 7.5 | 0.6 % | ||
| CVE-2026-59926 | < 3.2.1 | Mistune: XSS via unescaped class option in Admonition directive | MEDIUM 5.3 | 0.3 % | ||
| CVE-2026-59923 | < 3.3.0 | Mistune: XSS via percent-encoded javascript URI bypass in safe_url() | MEDIUM 6.1 | 0.3 % | ||
| CVE-2026-59930 | < 3.3.0 | Mistune toc / TableOfContents directive: heading IDs use predictable `toc_N` numbering with no slugification, allowing collision with att… | MEDIUM 4.3 | 0.2 % | ||
| CVE-2026-59922 | < 3.3.0 | Mistune plugins/formatting: quadratic-time parsing on long runs of `~~x~~`, `==x==`, and `^^x^^` markers (strikethrough / mark / insert) | HIGH 7.5 | 0.6 % | ||
| CVE-2026-49851 | < 3.3.0 | Mistune: Potential DoS via quadratic-time parsing in parse_link_text | HIGH 8.7 | 0.5 % | ||
| CVE-2026-44898 | < 3.2.1 | Mistune TOC Anchor Injection XSS | MEDIUM 6.1 | 0.2 % | ||
| CVE-2026-44897 | < 3.2.1 | Mistune Heading ID Attribute Injection XSS | MEDIUM 6.1 | 0.2 % | ||
| CVE-2026-44708 | < 3.2.1 | Mistune Math Plugin XSS Escape Bypass | MEDIUM 6.1 | 0.2 % | ||
| CVE-2026-44899 | < 3.2.1 | Mistune Image Directive CSS Injection Vulnerability | MEDIUM 6.1 | 0.2 % | ||
| CVE-2026-44896 | < 3.2.1 | Mistune: XSS via unescaped figclass/figwidth in Figure directive | MEDIUM 5.3 | 0.2 % | ||
| CVE-2026-33079 | >=3.0.0a1, <= 3.2.0 | Mistune ReDoS in LINK_TITLE_RE allows denial of service with crafted Markdown titles | HIGH 8.7 | 0.6 % |