- Products & ServicesProducts & Services
- SolutionsSolutions
- PricingPricing
- CompanyCompany
- ResourcesResources
en
en
A short verification protects source data and prevents automated AI requests.
Verifying...
As of 11/09/2026, mistune recorded 12 security vulnerabilities in the last 90 days, of which 9 are rated High or Critical. None of these vulnerabilities is actively exploited (KEV) according to CISA's catalog. CyStack recommends that organizations and individual users apply patches as soon as possible.
CyStack does not yet have sufficient official-source data to identify the latest version of mistune and determine which vulnerabilities affect that version.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-121438Mistune before 3.3.3 Denial of Service via Balanced Bracket Link ParsingCVE-2026-121437Mistune 3.3.0 before 3.3.4 Quadratic-Time DoS via _process_emphasis_delimitersCVE-2026-115355Mistune before 3.3.0 Path Traversal and XSS via Include DirectiveCVE-2026-115354Mistune before 3.3.0 Arbitrary Local File Read via Include DirectiveCVE-2026-115353Mistune before 3.3.0 Path Traversal via include Directive| Vulnerability | Exploitation status | Fix | Published | Severity |
|---|---|---|---|---|
CVE-2026-121438Mistune before 3.3.3 Denial of Service via Balanced Bracket Link Parsing | Exploitation statusNot confirmed | FixYes |
| SeverityMedium |
CVE-2026-121437Mistune 3.3.0 before 3.3.4 Quadratic-Time DoS via _process_emphasis_delimiters | Exploitation statusActively exploited | FixYes | Published11/03/2026 | SeverityHigh |
|---|
CVE-2026-115355Mistune before 3.3.0 Path Traversal and XSS via Include Directive | Exploitation statusNot exploited | FixYes | Published10/22/2026 | SeverityHigh |
|---|
CVE-2026-115354Mistune before 3.3.0 Arbitrary Local File Read via Include Directive | Exploitation statusActively exploited | FixYes | Published10/22/2026 | SeverityHigh |
|---|
CVE-2026-115353Mistune before 3.3.0 Path Traversal via include Directive | Exploitation statusNot confirmed | FixYes | Published10/22/2026 | SeverityCritical |
|---|
CVE-2026-115352Mistune before 3.3.0 Quadratic-Time DoS via Unmatched Brackets in Inline Parser | Exploitation statusNot exploited | FixYes | Published10/22/2026 | SeverityHigh |
|---|
CVE-2026-115351Mistune 3.2.1 before 3.3.0 CSS Injection via Figure Directive figwidth Option | Exploitation statusActively exploited | FixYes | Published10/22/2026 | SeverityMedium |
|---|
CVE-2026-115350Mistune before 3.3.0 Stored XSS via Include Directive HTML Files | Exploitation statusNot exploited | FixYes | Published10/22/2026 | SeverityMedium |
|---|
CVE-2026-115349Mistune 3.0.0 before 3.3.0 Denial of Service via Nested Bracket Parsing | Exploitation statusNot exploited | FixYes | Published10/22/2026 | SeverityHigh |
|---|
CVE-2026-115348Mistune before 3.3.0 Quadratic-Time DoS via parse_link_text | Exploitation statusNot exploited | FixYes | Published10/22/2026 | SeverityHigh |
|---|
CVE-2026-115347Mistune before 3.3.0 Quadratic Denial of Service via parse_link_text | Exploitation statusNot exploited | FixYes | Published10/22/2026 | SeverityHigh |
|---|
CVE-2026-76098Mistune has Denial of Service — RecursionError via Excessive Emphasis Markers in Markdown | Exploitation statusActively exploited | FixYes | Published08/24/2026 | SeverityHigh |
|---|
CVE-2026-59930Mistune toc / TableOfContents directive: heading IDs use predictable `toc_N` numbering with no slugification, allowing collision with attacker-controlled `id="toc_N"` content | Exploitation statusActively exploited | FixYes | Published07/08/2026 | SeverityMedium |
|---|
CVE-2026-59929Mistune renderers/html.safe_url: HARMFUL_PROTOCOLS list misses legacy and chained schemes that historically chain to `javascript:` execution | Exploitation statusNot exploited | FixYes | Published07/08/2026 | SeverityMedium |
|---|
CVE-2026-59928Mistune block_parser: quadratic-time parsing on long lists of repeated reference-link definitions | Exploitation statusActively exploited | FixYes | Published07/08/2026 | SeverityHigh |
|---|
CVE-2026-59927Mistune directives/include: mutual `.. include::` recursion crashes the renderer with `RecursionError`, denial of service via two attacker-controlled markdown files | Exploitation statusNot exploited | FixYes | Published07/08/2026 | SeverityMedium |
|---|
CVE-2026-59926Mistune: XSS via unescaped class option in Admonition directive | Exploitation statusNot exploited | FixYes | Published07/08/2026 | SeverityMedium |
|---|
CVE-2026-59925inline_parser: quadratic-time parsing on long runs of `**x**` and `***x***` emphasis pairs | Exploitation statusNot exploited | FixYes | Published07/08/2026 | SeverityHigh |
|---|
CVE-2026-59924Mistune: Arbitrary File Read via Include directive path traversal | Exploitation statusNot exploited | FixYes | Published07/08/2026 | SeverityMedium |
|---|
CVE-2026-59923Mistune: XSS via percent-encoded javascript URI bypass in safe_url() | Exploitation statusActively exploited | FixYes | Published07/08/2026 | SeverityMedium |
|---|
CVE-2026-59922Mistune plugins/formatting: quadratic-time parsing on long runs of `~~x~~`, `==x==`, and `^^x^^` markers (strikethrough / mark / insert) | Exploitation statusActively exploited | FixYes | Published07/08/2026 | SeverityHigh |
|---|
CVE-2026-49851Mistune: Potential DoS via quadratic-time parsing in parse_link_text | Exploitation statusActively exploited | FixYes | Published06/24/2026 | SeverityHigh |
|---|
CVE-2026-44899Mistune Image Directive CSS Injection Vulnerability | Exploitation statusActively exploited | FixYes | Published05/26/2026 | SeverityMedium |
|---|
CVE-2026-44898Mistune TOC Anchor Injection XSS | Exploitation statusActively exploited | FixYes | Published05/26/2026 | SeverityMedium |
|---|
CVE-2026-44897Mistune Heading ID Attribute Injection XSS | Exploitation statusNot exploited | FixYes | Published05/26/2026 | SeverityMedium |
|---|
CVE-2026-44896Mistune: XSS via unescaped figclass/figwidth in Figure directive | Exploitation statusNot exploited | FixNo | Published05/26/2026 | SeverityMedium |
|---|
CVE-2026-44708Mistune Math Plugin XSS Escape Bypass | Exploitation statusActively exploited | FixYes | Published05/26/2026 | SeverityMedium |
|---|
CVE-2026-33079Mistune ReDoS in LINK_TITLE_RE allows denial of service with crafted Markdown titles | Exploitation statusActively exploited | FixNo | Published05/06/2026 | SeverityHigh |
|---|
28 Results | Page 1 of 1