CVE-2026-44896

Mistune versions 3.3.0 through 3.3.2 are vulnerable to DoS through deeply nested tokens. HTML rendering creates deeply nested emphasis tokens from asterisks, and recursive rendering can exceed Python's recursion limit, causing a crash. Fixed in version 3.3.3.

In the Mistune Python Markdown parsing library, a vulnerability was found in the toc plugin and TableOfContents directive. They generate heading IDs as predictable toc_N values without slugifying the heading text, allowing an attacker to inject their own id="toc_N" and collide with generated anchors.

Mistune, a Python Markdown parser, prior to version 3.3.0 has a vulnerability due to insufficient filtering of dangerous URI schemes in href and src attributes. The safe_url filter only blocks javascript:, vbscript:, file:, and data: schemes, allowing legacy or chained schemes such as feed:, view-source:, jar:, livescript:, mocha:, ms-its:, mk:, and res: to reach rendered attributes, potentially enabling script execution in affected user agents.

A vulnerability in the Mistune Python Markdown parser before version 3.3.0 allows a denial of service attack via CPU exhaustion. A Markdown document containing many repeated or distinct reference-link definitions causes quadratic complexity in src/mistune/block_parser.py and the ref_links dictionary handling.

A vulnerability in the Mistune Python Markdown parser before version 3.3.0 allows unbounded recursion via two Markdown files that include each other. This triggers a RecursionError and crashes the rendering process.

In the Mistune Python library, a vulnerability exists due to improper escaping of the :class: option of the Admonition directive before inserting it into the HTML class attribute. This allows attribute injection and XSS attacks even when HTMLRenderer escape mode is enabled. The issue is fixed in version 3.2.1.

Mistune is a Python Markdown parser. Prior to version 3.3.0, long sequences of well-formed double-asterisk or triple-asterisk emphasis pairs around a character cause quadratic work in src/mistune/inline_parser.py because the parser scans forward for matching close markers from every potential opening run, allowing denial of service in default Mistune parsing.

Mistune is a Python Markdown parser. Prior to version 3.3.0, Include.parse() joins and normalizes user-supplied include paths without verifying that the result remains within the intended markdown directory, allowing crafted include paths to access files outside that directory when markdown files are processed using md.read().

In the Mistune Python library, a vulnerability exists where HTMLRenderer.safe_url() does not block percent-encoded javascript URIs. This allows an attacker to bypass URL protections in Markdown links or images and execute script in rendered HTML.

A vulnerability in the Mistune Python Markdown parser before version 3.3.0 causes quadratic computational complexity when processing sequences of closed tilde, equals-sign, or caret markers in strikethrough, mark, and insert plugins. An attacker can exploit this to cause CPU exhaustion (denial of service).