TI-2026-42736 CVE-2026-59928 · GHSA-ffq3-xpv3-j92q
Mistune block_parser: quadratic-time parsing on long lists of repeated reference-link definitions
Priority HIGH 72
Mistune is a Python Markdown parser with renderers and plugins.
lepture
Records31All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high14CVSS 7.0–8.9
Exploited now
lepture records in CISA KEVNo lepture vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
17 records in Mistune · all components
TI-2026-42730 CVE-2026-59922 · GHSA-c8j7-8cv4-2xmq
Regular expression denial of service in lepture mistune
Priority HIGH 72
Mistune is a Python Markdown parser with renderers and plugins.
TI-2026-42731 CVE-2026-59923 · GHSA-8c25-4j27-2rv3
Mistune: XSS via percent-encoded javascript URI bypass in safe_url()
Priority MEDIUM 60
Mistune is a Python Markdown parser with renderers and plugins.
TI-2026-32774 CVE-2026-44899 · GHSA-ccfx-mfmx-2fx9
Mistune Image Directive CSS Injection Vulnerability
Priority MEDIUM 60
Mistune is a Python Markdown parser with renderers and plugins.
TI-2026-32773 CVE-2026-44898 · GHSA-6269-cqxg-mhhv
Mistune TOC Anchor Injection XSS
Priority MEDIUM 60
Mistune is a Python Markdown parser with renderers and plugins.
TI-2026-32595 CVE-2026-44708 · GHSA-8g87-j6q8-g93x
Mistune Math Plugin XSS Escape Bypass
Priority MEDIUM 60
Mistune is a Python Markdown parser with renderers and plugins.
TI-2026-42738 CVE-2026-59930 · GHSA-2hm2-hc3v-44h9
Insufficient verification of data authenticity in lepture mistune
Priority MEDIUM 53
Mistune is a Python Markdown parser with renderers and plugins.
TI-2026-42733 CVE-2026-59925 · GHSA-4j32-57v6-6g45
inline_parser: quadratic-time parsing on long runs of `**x**` and `***x***` emphasis pairs
Priority MEDIUM 40
Mistune is a Python Markdown parser with renderers and plugins.
TI-2022-15559 CVE-2022-34749 · GHSA-fw3v-x4f2-v673
In mistune through 2.0.2, support of inline markup is implemented by using regular…
Priority LOW 36
In mistune through 2.0.2, support of inline markup is implemented by using regular expressions that can involve a high amount of backtracking on certain edge cases.
TI-2017-12421 CVE-2017-16876 · GHSA-98gj-wwxm-cj3h
Cross-site scripting (XSS) vulnerability in the _keyify function in mistune.py in Mistune…
Priority LOW 32
Cross-site scripting (XSS) vulnerability in the _keyify function in mistune.py in Mistune before 0.8.1 allows remote attackers to inject arbitrary web script or HTML by leveraging failure to escape the "key" argument.
TI-2026-42735 CVE-2026-59927 · GHSA-8mpj-m6qm-5qr8
Uncontrolled recursion in lepture mistune
Priority LOW 31
Mistune is a Python Markdown parser with renderers and plugins.
TI-2026-32771 CVE-2026-44896 · GHSA-58cw-g322-p94v
Mistune: XSS via unescaped figclass/figwidth in Figure directive
Priority LOW 29
Mistune is a Python Markdown parser with renderers and plugins.
TI-2017-11404 CVE-2017-15612 · GHSA-hpv5-v8g5-c864
mistune.py in Mistune 0.7.4 allows XSS via an unexpected newline (such as in…
Priority LOW 29
mistune.py in Mistune 0.7.4 allows XSS via an unexpected newline (such as in java\nscript:) or a crafted email address, related to the escape and autolink functions.
TI-2026-42737 CVE-2026-59929 · GHSA-qfrw-5rxm-mhh2
Cross-site scripting in lepture mistune
Priority LOW 27
Mistune is a Python Markdown parser with renderers and plugins.
TI-2026-42732 CVE-2026-59924 · GHSA-r4rv-85jg-w4mf
Mistune: Arbitrary File Read via Include directive path traversal
Priority LOW 27
Mistune is a Python Markdown parser with renderers and plugins.
TI-2026-32772 CVE-2026-44897 · GHSA-v87v-83h2-53w7
Mistune Heading ID Attribute Injection XSS
Priority LOW 27
Mistune is a Python Markdown parser with renderers and plugins.
TI-2026-42734 CVE-2026-59926 · GHSA-g97x-gvcm-x72h
Mistune: XSS via unescaped class option in Admonition directive
Priority LOW 24
Mistune is a Python Markdown parser with renderers and plugins.