Vulnerabilities for mistune

First version without a known vulnerability: 3.3.0

Details

• GHSA-qfrw-5rxm-mhh22026-07-20

  Mistune renderers/html.safe_url: HARMFUL_PROTOCOLS list misses legacy and chained schemes that historically chain to `javascript:` execution

  Fixed in: 3.3.0

• GHSA-2hm2-hc3v-44h92026-07-20

  Mistune toc / TableOfContents directive: heading IDs use predictable `toc_N` numbering with no slugification, allowing collision with attacker-controlled `id="toc_N"` content

  Fixed in: 3.3.0

• GHSA-r4rv-85jg-w4mf2026-07-20

  Mistune: Arbitrary File Read via Include directive path traversal

  Fixed in: 3.3.0

• GHSA-c8j7-8cv4-2xmq2026-07-20

  Mistune plugins/formatting: quadratic-time parsing on long runs of `~~x~~`, `==x==`, and `^^x^^` markers (strikethrough / mark / insert)

  Fixed in: 3.3.0

• GHSA-g97x-gvcm-x72h2026-07-20

  Mistune: XSS via unescaped class option in Admonition directive

  Fixed in: 3.3.0

• GHSA-8c25-4j27-2rv32026-07-20

  Mistune: XSS via percent-encoded javascript URI bypass in safe_url()

  Fixed in: 3.3.0

• GHSA-4j32-57v6-6g452026-07-20

  Mistune inline_parser: quadratic-time parsing on long runs of `**x**` and `***x***` emphasis pairs

  Fixed in: 3.3.0

• GHSA-8mpj-m6qm-5qr82026-07-20

  Mistune directives/include: mutual `.. include::` recursion crashes the renderer with `RecursionError`, denial of service via two attacker-controlled markdown files

  Fixed in: 3.3.0

• GHSA-ffq3-xpv3-j92q2026-07-20

  Mistune block_parser: quadratic-time parsing on long lists of repeated reference-link definitions

  Fixed in: 3.3.0

• GHSA-qcq2-496w-v96p2026-07-09

  Mistune: Potential DoS via quadratic-time parsing in parse_link_text

  Fixed in: 3.3.0

• GHSA-ccfx-mfmx-2fx92026-05-14

  Mistune Image Directive CSS Injection Vulnerability

  Fixed in: 3.2.1

• GHSA-6269-cqxg-mhhv2026-05-14

  Mistune TOC Anchor Injection XSS

  Fixed in: 3.2.1

• GHSA-v87v-83h2-53w72026-05-09

  Mistune Heading ID Attribute has Injection XSS

  Fixed in: 3.2.1

• GHSA-58cw-g322-p94v2026-05-08

  Mistune has XSS via unescaped figclass/figwidth in Figure directive

  Fixed in: 3.2.1

• GHSA-8g87-j6q8-g93x2026-05-08

  Mistune Math Plugin has an XSS Escape Bypass

  Fixed in: 3.2.1

• GHSA-8mp2-v27r-99xp2026-05-06

  Mistune has a ReDoS in LINK_TITLE_RE that allows denial of service via crafted Markdown input

  Fixed in: 3.2.1

• GHSA-fw3v-x4f2-v6732022-07-26

  Mistune vulnerable to catastrophic backtracking

  Fixed in: 2.0.3, a6d43215132fe4f3d93f8d7e90ba83b16a0838b2

• GHSA-hpv5-v8g5-c8642022-05-17

  Cross-site Scripting in Mistune

  Fixed in: 0.8

• GHSA-98gj-wwxm-cj3h2019-01-04

  mistune Cross-site scripting (XSS) vulnerability

  Fixed in: 0.8.1, 5f06d724bc05580e7f203db2d4a4905fc1127f98