What’s Vulnerable › Products
lepture mistune vulnerabilities
29 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 26 published in the last 12 months.
Check whether your lepture mistune version is affected
Latest lepture mistune vulnerabilities
- CVE-2026-115353 — Mistune before 3.3.0 Path Traversal via include Directive (CVSS 8.6)
- CVE-2026-115352 — Mistune before 3.3.0 Quadratic-Time DoS via Unmatched Brackets in Inline Parser (CVSS 7.5)
- CVE-2026-115349 — Mistune 3.0.0 before 3.3.0 Denial of Service via Nested Bracket Parsing (CVSS 7.5)
- CVE-2026-115348 — Mistune before 3.3.0 Quadratic-Time DoS via parse_link_text (CVSS 7.5)
- CVE-2026-115347 — Mistune before 3.3.0 Quadratic Denial of Service via parse_link_text (CVSS 7.5)
- CVE-2026-115355 — Mistune before 3.3.0 Path Traversal and XSS via Include Directive (CVSS 7.5)
- CVE-2026-115354 — Mistune before 3.3.0 Arbitrary Local File Read via Include Directive (CVSS 6.5)
- CVE-2026-115351 — Mistune 3.2.1 before 3.3.0 CSS Injection via Figure Directive figwidth Option (CVSS 4.7)
- CVE-2026-115350 — Mistune before 3.3.0 Stored XSS via Include Directive HTML Files (CVSS 6.1)
- CVE-2026-76098 — Mistune has Denial of Service — RecursionError via Excessive Emphasis Markers in Markdown (CVSS 7.5)
- CVE-2026-59930 — Mistune toc / TableOfContents directive: heading IDs use predictable `toc_N` numbering with no slugification, allowing collision with attacker-controlled `id="toc_N"` content (CVSS 4.3)
- CVE-2026-59929 — Mistune renderers/html.safe_url: HARMFUL_PROTOCOLS list misses legacy and chained schemes that historically chain to `javascript:` execution (CVSS 6.1)
- CVE-2026-59928 — Mistune block_parser: quadratic-time parsing on long lists of repeated reference-link definitions (CVSS 7.5)
- CVE-2026-59927 — Mistune directives/include: mutual `.. include::` recursion crashes the renderer with `RecursionError`, denial of service via two attacker-controlled markdown files (CVSS 5.3)
- CVE-2026-59926 — Mistune: XSS via unescaped class option in Admonition directive (CVSS 6.1)
- CVE-2026-59925 — inline_parser: quadratic-time parsing on long runs of `**x**` and `***x***` emphasis pairs (CVSS 7.5)
- CVE-2026-59924 — Mistune: Arbitrary File Read via Include directive path traversal (CVSS 5.9)
- CVE-2026-59923 — Mistune: XSS via percent-encoded javascript URI bypass in safe_url() (CVSS 6.1)
- CVE-2026-59922 — Mistune plugins/formatting: quadratic-time parsing on long runs of `~~x~~`, `==x==`, and `^^x^^` markers (strikethrough / mark / insert) (CVSS 7.5)
- CVE-2026-49851 — Mistune: Potential DoS via quadratic-time parsing in parse_link_text (CVSS 7.5)
- CVE-2026-44899 — Mistune Image Directive CSS Injection Vulnerability (CVSS 6.1)
- CVE-2026-44898 — Mistune TOC Anchor Injection XSS (CVSS 6.1)
- CVE-2026-44897 — Mistune Heading ID Attribute Injection XSS (CVSS 6.1)
- CVE-2026-44896 — Mistune: XSS via unescaped figclass/figwidth in Figure directive (CVSS 6.1)
- CVE-2026-44708 — Mistune Math Plugin XSS Escape Bypass (CVSS 6.1)