Mistune: XSS via unescaped class option in Admonition directive

概要

参考情報

• lepture/mistune security advisory · WEB
• nvd.nist.gov/vuln/detail/CVE-2026-59926 · ADVISORY
• lepture/mistune commit a3cb6e5 · WEB
• lepture/mistune · PACKAGE
• lepture/mistune release v3.2.1 · WEB
• pypa/advisory-database · WEB

mistune のその他の脆弱性

• CVE-2026-115355高 7.5Mistune before 3.3.0 contains a path traversal vulnerability in the Include directive that allows attackers to read arbitrary files by suppl…
• CVE-2026-76098高 7.5Mistune is a Python Markdown parser with renderers and plugins. Versions 3.3.0 through 3.3.2 are vulnerable to DoS through deeply nested tok…
• CVE-2026-59930中 4.3Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, the toc plugin and TableOfContents directive generate headin…
• CVE-2026-59929中 6.1Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, the safe_url filter in src/mistune/renderers/html.py blocks …
• CVE-2026-59928高 7.5Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, a Markdown document containing many repeated or distinct ref…