python3Packages.mistune_2

GHSA-2hm2-hc3v-44h9 medium 4.3 public exploit Mistune toc / TableOfContents directive: heading IDs use predictable `toc_N` numbering with no slugification, allowing collision with attacker-controlled `id="toc_N"` content (OSV, for this version)

GHSA-4j32-57v6-6g45 high 7.5 Mistune inline_parser: quadratic-time parsing on long runs of `**x**` and `***x***` emphasis pairs (OSV, for this version)

GHSA-58cw-g322-p94v medium 5.3 EPSS 0.3% Mistune has XSS via unescaped figclass/figwidth in Figure directive (OSV, for this version)

GHSA-8c25-4j27-2rv3 medium 6.1 public exploit Mistune: XSS via percent-encoded javascript URI bypass in safe_url() (OSV, for this version)

GHSA-8g87-j6q8-g93x medium 6.1 public exploit EPSS 0.3% Mistune Math Plugin has an XSS Escape Bypass (OSV, for this version)

GHSA-8mpj-m6qm-5qr8 medium 5.3 Mistune directives/include: mutual `.. include::` recursion crashes the renderer with `RecursionError`, denial of service via two attacker-controlled markdown files (OSV, for this version)

GHSA-c8j7-8cv4-2xmq high 7.5 public exploit Mistune plugins/formatting: quadratic-time parsing on long runs of `~~x~~`, `==x==`, and `^^x^^` markers (strikethrough / mark / insert) (OSV, for this version)

GHSA-ffq3-xpv3-j92q high 7.5 public exploit Mistune block_parser: quadratic-time parsing on long lists of repeated reference-link definitions (OSV, for this version)

GHSA-g97x-gvcm-x72h medium 5.3 Mistune: XSS via unescaped class option in Admonition directive (OSV, for this version)

GHSA-qcq2-496w-v96p high 8.7 public exploit EPSS 0.6% Mistune: Potential DoS via quadratic-time parsing in parse_link_text (OSV, for this version)

GHSA-qfrw-5rxm-mhh2 medium 6.1 Mistune renderers/html.safe_url: HARMFUL_PROTOCOLS list misses legacy and chained schemes that historically chain to `javascript:` execution (OSV, for this version)

GHSA-r4rv-85jg-w4mf medium 5.9 Mistune: Arbitrary File Read via Include directive path traversal (OSV, for this version)

GHSA-v87v-83h2-53w7 medium 6.1 EPSS 0.3% Mistune Heading ID Attribute has Injection XSS (OSV, for this version)

PYSEC-2026-2208 medium 6.1 public exploit EPSS 0.3% Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.2.1, render_toc_ul() builds a <ul> table-of-contents tree from a list of (level, id, text) tuples. Both the id value (used as href="#<id>") and the text value (used as the visible link label) are inserted into <a> tags via a (OSV, for this version)

PYSEC-2026-2209 medium 4.7 public exploit EPSS 0.3% Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.2.1, the Image directive plugin validates the :width: and :height: options with a regex compiled as _num_re = re.compile(r"^\d+(?:\.\d*)?"). When the validated value is not a plain integer, render_block_image() inserts it dir (OSV, for this version)